I, for my sins, have had to read PCI certification standards, and they're required to be encrypted, or not stored at all. Not that every implementation follows that, of course, but that's the expectation.