from Hacker News

Directly from their Digital Services Agreement you must accept before using their site (emphasis mine):

If you disclose your Card numbers, account numbers, PINs, user IDs, and/or Passwords to any person or entity, including any employee or agent, you assume all risks and losses associated with such disclosure. If you permit any other person(s) or entity(ies), including any data aggregation service providers, to use the Digital Platforms, any Service, or to access or use your Card numbers, account numbers, PINs, user IDs, Passwords, or other means to access your accounts, you are authorizing any transactions and activities performed by them and are responsible for any transactions and activities performed from your accounts and for any use of your personal and account information by any person or entity to whom they may provide that personal and account information.

So if I disclose a Card #, which could be expected in a normal conversation, and that employee commits fraud, they're trying to escape liability. I'm cynical but this is a step farther than normal.