Accepting credit card payments on her site means she is responsible for their data, and anything that happens to it. She will also have to make sure her site is in compliance with the requirements of each card she accepts.

With GCO, and Paypal Express the responsibility is with Google and Paypal not the store owner.

I’m not saying she shouldn’t accept payments on her site, but she should also think about the possibility of having to notify all current and past customers that their credit card information could have been compromised if her store if ever hacked. That would destroy the stores reputation and possible her’s as well.

Even with the risks I'd do it, but I'd use a real Merchant Account, like Authorize.net, or LinkPoint.

Gary