It's stored on the server, so that it can put the information in when you order something. Apparently, that happens. If that's the case, then when someone breaks into your account, they merely need to buy something and intercept the request, and voila, they have it.