No, they also need CVV2 and expiration date. (That said, a 3 digit number is easy to crack. The date is just 1 bit on top.) In more modern setups, there are th

No, they also need CVV2 and expiration date. (That said, a 3 digit number is easy to crack. The date is just 1 bit on top.) In more modern setups, there are things like MasterCard Secure or Visa 3D Secure which require direct authorisation with a token. (One time key, token hardware, phone secure element token.) The tokens are much more secure than PKI without a password. And then there are decent banks that will put suspicious and/or big transactions on hold for phone authorization. And you cannot change auth data easily without knowing the account password and potentially again authorizing changes with a token. (Remember to disallow changing data over the phone. Most banks require extra work to enable phone account management anyway.) And in any case you can dispute the suspicious transaction and probably get notifications about these.