Saw this answer from a response to your same post on TripAdvisor. Makes sense now. "they're single-use credit card numbers (like a Visa gift card), not the people's actual credit card info. Still bad they sent them to the wrong person, but it's a grand total of $12 at risk."
.
