Most recurring billing providers handle the credit card numbers for you. So after you pass them along to their API you never need them again.

Isn't it more secure not to reinvent every wheel yourself? I'm much rather let others deal with their core competencies than spend all my new feature cycles making yet another create/confirm/forgot authentication boiler plate.