It’s up to the merchant to decide. You can ask for as little as card number and expiry. All up to the merchant based on how they configure their payment processor