> I want to say that's really unlikely. That would mean that there's a database of credit card numbers associated with their owner's employer, which would be troubling on multiple levels.

Sounds like something Acxiom (http://www.acxiom.com/) would likely have.