An Issue with Battle.net Payment Services

So an officer in our guild was hacked this morning. Out of everything that happened, we were appalled to find out that the hacker charged our officer's credit card to move his two 80s to different servers. The credit card is saved on his Battle.net account.

How is it OK that someone should be able to just have a credit card at their disposal? Like any OTHER site where you have to pay with a credit card, you should have to verify your credit card information. Whether it be with the security code, or some other piece of personal information.

And if it actually does ask for this information, then the hacker had that info and that's a totally different story.