Giving them the benefit of a doubt, it could be a first (or half) step in adding a level of security around credit information. It wasn't long ago that they were breached (not though user identity checking! by a software vuln!) and they're probably still smarting from it. Maybe this is part of a half-baked auth scheme or notification system.