The big issue there is that they store credit card data at all.

And of course that some simple public number is enough to authorise payment.