[bcrescimanno]

A couple of things. First, I used the phrase "debit card number" to basically mean, "they didn't have my physical card--but they did have the information to be able to use it."

Second, this happened circa 2004-2005. In the US, at the time, all card use was magnetic strip swipes. Debit cards occasionally used a pin at terminals equipped to do so; but, it wasn't a requirement and most use didn't involve the pin. As an example: a grocery store terminal at the cash register might require your pin; but, if you paid the bill at a restaurant, it would get swiped like any Visa/MC.

At the time, in an online setting, asking for additional information like CVV or using address for AVS wasn't standardized so not all merchants required anything beyond a card number and expiration date.

In that era, nearly everyone I knew had experienced a debit card or credit card stolen and used in this manner--and those with debit cards paid the extra price of actually losing our money for a time.