Yep, and they are going to ask for a CVV. The way that all of this stuff works is that they get the full CC info up from, do a test authorization against that, then toss the CVV (theoretically, assuming they comply with PCI) then retain the CC # and EXP. associated with your account.
Nobody is going to just ask for the CC up front, then come back later and say they also need a EXP and CVV, which is the only way this scam would work. Since the merchant isn’t allowed to store the CVV they are going to do a test authorization right away.
That gift card scam though - that would totally work and I doubt you could get in legal trouble for it, though they would probably send you to collection if you used any services that they later attempted to charge to the card in excess of $1.
