This situation reminds me a lot of the hypothetical situation outlined in this post [1]. Definitely worth the read for anyone who hasn't already seen it.

[1] https://hackernoon.com/im-harvesting-credit-card-numbers-and...