Yes, I have wondered about that too. Even online systems or ordering by mail is no protection. Your mailed letter has to be handled by someone at that end-what's to stop them from writing down the numbers? And online-your info is stored supposedly encrypted, but can it be read-does the web owner hold the encryption key?

I am a paranoid Annie at times.

Phone verification is the conventional method adopted, still in use to date.

Well when someone purchased from a stolen paypal account, the paypal account owner messaged me and asked why is there a payment to me. And I said they ordered hosting. And eventually I refunded the paypal order and report the fraudster to the ISP. Then according to the ISP the fraudster had their internet cut off after that.