Nothing is completely secure. Giving out Credit/Debit card numbers on a website can lead to theft too. Giving out bank account numbers can to. In both cases consumer is indemnified as along as they flag the transaction within 60 days. The problem is the hassle of dealing with the banks etc.