From their perspective, how else would you track unique users on the internet? By asking for CC number, you are outsourcing the identity verification to a bank. It is certainly more 'secure' than email, what other options would you suggest?