holding the credit card info is required for processing a refund. This is to both avoid merchant services fees for refunded transactions and prevent various types of fraud. For a very very small uptick in merchant services fees, vendors can increase the security of storing credit card numbers through what is called tokenization which is stronger security than encryption. Vendors should also have the storage of credit card numbers be done by the major merchant services firm or processor, since those servers are often more secure and professionally managed for this type of sensitive info.

What worries me, if it is still a Fish and Game practice, is the requiring of a social security number for a license. Years ago my father visited from another State, Fish and Game would not sell him an out-of-state 3-day fishing permit without all his personal info including his social security number. With this info any hacker could easily create identity theft. Why to go fishing you must present a social security number is absurd and stinks of lazy system design to use a SS# for a unique customer identifier in the database.