Disclosing ID and verifying it are completely separate issues. Also, the information leak here causes problems for more than just the credit card company; the data transferred in plain opens up the possibility of more than plain credit card fraud (although that is the most obvious exploit).

I seriously doubt that Schneier would consider this information disclosure OK based on this loose interpretation of his blog post.