when you think about it, we hand over card numbers, 3 digit security code, expiry dates and addresses all the time. I assumed it was usually encrypted online but smaller businesses often take payments over the phone, emailed forms etc so visible to any lowlife given an opportunity.