Booking.com uses an agency model with hotels and doesn't handle any payment from the user. They basically get a commission once your stay is completed. What this means is that they pass on your information to the hotel so that they handle billing/charging, etc.

This is in contrast to most OTAs in the US that are on a merchant model where they charge your credit card and have a pre-agreed upon net rate they pay for rooms to the hotel. This means the hotel has no idea what your credit card is or how you paid, just that a paid reservation with their partner was made.

This isn't very different than calling up a hotel and providing your credit card number and CVV / Expiration date on the phone to make a reservation. Only difference is that they sent it electronically.