Those of us who transact directly with the hotel instead of booking agents stay winning I guess.
Third-party aggregators and hotels are a complete shit-show. But as long as I can save $30 on my trip, I will keep using them...
The real solution is for the credit card companies to lay down requirements for these merchants (no storing in plain text).
The CVC is just slightly less problematic than the rest of the card data.
And that small hotel in Tyrol is probably ok, but I had my card cloned within minutes of eating at a restaurant in Toronto. The whole concept of a bunch of numbers that allow for arbitrary charges against you is flawed.
Booking.com doesn't facilitate fraud any more than your credit card company does, and so far I've been able to successfully dispute every charge that I did not agree with on my card. The day that changes I'll stop using them entirely.
I haven't had my card imprinted (or, later, photocopied) in hotels since a long time. Now it's just a pre-authorization.
Although recently I had my credit card photocopied by a car rental agency so they would be able to phone the card processor and cancel the pre-auth manually. Absolute madness.
> the only thing the hotel doesn't have is the CVC
Considering the most recent credit cards that I have been issued, most lost the embossing and now print the PAN on the back together with the CVC, so if some hotel photocopies the card - as nobody have the imprinters anymore - the CVC is there. This also applies to the last embossed card that I have in my wallet, an Amex card, which always had the CVC on the front that wasn't captured with an imprinter. Now with photocopiers, it is.
If they wouldn't send the card information 'in plain text' it would be useless to the hotel. And every time you visit a hotel and hand them your card they tend to make an imprint of the card, the only thing the hotel doesn't have is the CVC and in the normal flow this isn't exposed, only when you escalate to some level of exception (and I'm not sure what the criteria are for that).