Presumably you suggested a hash of the credit card number, because passing them the actual credit card number would be bad?

Well, you couldn't use a hash for this. It would take hardly any time at all to generate a rainbow table which covers all possible credit card numbers.