"It's okay because 'fraud prevention' " isn't a good enough reason to horde my user's data without their consent.

Furthermore, a heartfelt promise from a payment provider to never sell my data means about diddly squat to me.