[entwisi]

yes it could be unscrupulous employees although you are always at the mercy of retailers in this respect. The good ones actually use mechant services where they do not see your details at all. They just get a auth code to say you have paid XXX.

In your particular case its hard to say whether they had all the details that would be needed for an online transaction or they were trying a restricted access dealer who doesn't need to have all the same security checks in place. Out of interest what were they trying to buy from where?Was it overseas?