Many online payment processors have integrations that don't require card information to reach the merchant's server. For example, if you use Stripe[0], the merchant only receives a token that can be used for API calls. If you use Apple Pay or Google Pay, regardless of payment processor, the merchant receives a transaction-specific credit card.

[0] https://stripe.com/us/payments