In fact they (the retailer) *should* look up the bank/card company number in the phone book rather than rely on a number supplied by the "customer". Otherwise the crooks could supply a number that *they* will answer, and it's "Yes, Mr. Hobby Horse, that card number IS valid, and no, there's no report of it being stolen." Obviously takes some organisation by the crooks, but even so....