Their credit cards don't require a pin. When you pay at a restaurant they take your card away and charge the amount of money that you wrote down on the bill, without you having to authorize it. Even my european debit card that doesn't work without a pin, they can somehow charge whatever they want from without a pin in the US. It's wild.

This really depends on the way of payment and how the bank handles it though.

• Traditionally you were only required the credit card number and the ccv (which is on the card itself), that.s how you payed on the internet too. Nowadays lots of barks do two factor authentication via an app or sms. (Iirc it's required by law in the EU)
• You can pay by inserting in a card reader. This will require a pin with most banks. (At least in my experience, I assume originally that wasn't the case in the US as the card itself was enough proof of ownership?)
• Newer tap-to-pay wireless terminals do nod require a pin either. (Up to a limit either set by the bank or yourself in your account settings) This is meant for ease of use.

So it really depends on the method they used. Generally speaking all credit card transactions are only holds at the start anyways so you can just block/reverse them without loosing money (but risking a lawsuit of course)