your absolutely right both ends are at risk but its a matter of trust which i would actually be willing to act first by giving the card number and pin so the balance could be checked they do this...