Probably meant sending the payment details without tokenization, which in practice means sending a merchant-specific (in case of this one, hotel-specific) card details (https://www.emvco.com/emv-technologies/payment-tokenisation/). A lot of hotels, for some reason that I still don't know, are still relying on MOTO methods to process payments, and MOTO requires the whole card number/PAN, name on file, expiry, and CVV to be sent (which I encounter from-time-to-time because my non-MOTO Mastercard is being rejected for being too weird). Combine that with the fact that US cards don't really enforce 3DS means that you'll have a card number bonanza usable for most American stores.

What is MOTO? Nothing helpful from internet search or link in parent comment.

Likely Mail Order/Telephone Order

https://blog.payjunction.com/moto-processing-definition

A)

1. Booking request made, Booking.com holds card details

2. Hotel requests payment

3. Booking.com makes transaction from your card to hotel

B)

1) Booking request made

2) Booking.com requires card details for immediate payment to them

3) Booking.com sends money from their account to hotel

C)

1) Booking request made, Booking.com requires guest identity only

2) Hotel takes payment on arrival

At least for me it usually works that way when I’m paying immediately/directly in booking.

The charge comes from Booking itself and I assume they ten transfer the money to the hotel/etc