I think - though I could be wrong - that it will pass an error if you try to set up a second billing profile with the same credit card number. And as I mentioned in another thread, you could theoretically store a one-way hash of the credit card number in your database along with the profile ID. That way you can match on the credit card number, but anyone who gains access to your database would have to run through a vritually infinite number of combinations to guess it.
