Imagine you could make payments with a salted and hashed credit card number.

Except that doesn't really make anything better, because now an attacker could simply use that salted and hashed credit card number elsewhere to make payments too!

The real solution is to use something like OAuth for payments. You authorize a merchant to take ongoing payments from you, and the card issuer gives the merchant a token which is only useful for making payments from you to them, and can't be used to make payments to anyone else.

Isn't that basically what Apple Pay does?

Apple pay uses a card number per merchant, but that card number could still be used at any other merchant. Eventually that loophole could be closed, but payment systems move like molasses... Expect it to take 20+ years...

It simply means if the card number is used for fraud, it'll be easier to track down who leaked the card numbers.

Whilst you can't hash it like a password as you need to be able to transfer it onwards, modern systems make tokenisation possible, where you immediately pass the details to the card processor, don't store them at all, and get back a token that can be used for that transaction.

https://squareup.com/gb/townsquare/what-does-tokenization-ac...

Not if you need to reverse it to actually send to payment card processor.