In the late 90s. Remember that the first PCI standard wasn't published until 2004; people were largely right to intuit that hackers stealing credit cards was a big problem that wasn't being adequately addressed.