We have this well established thing called a credit score which is handled by the credit card agency and resolves trust issues for the merchant entirely. If a person suspects identity theft, they can put a hold on a card, preventing further use. Cards have expiration dates and periodically cycle out. I'm sorry but when people explain to me that using a token they are personally responsible for encrypting is "safer" somehow, I raise my eyebrows.