A suspicious thread is over at WebmasterWorld named Google Credit Card Copies Request where a member says Google sent him the following email.
Photocopy the front and back of the credit/debit card you used to set up your account. For security purposes, please black out the first 12 digits of your card number, leaving only the last 4 digits visible.Fax it to the number ......... or send a scaned copy in an email.
The AdWords customer called Google to verify, which was smart and they told him that "it was legit but that the department requesting the copies did not have phone service capabilities to talk to me personally."
Why doesn't the billing department have "phone service capabilities"? And why does Google need those photocopies? And what about virtual credit card numbers?
Forum discussion at WebmasterWorld.
