they should never ask for the credit card because they did NOT processed the transaction.
You pay to hotels.com ( expedia ) not to the hotel. the reservation can be made by someone else is not required to be made by guests .
I never got problems with expedia .. if order looks like fraudulent...