yes. humans taking credit card numbers over the phone is a huge PCI violation. you can’t garantee they didn’t write it down. the other one thats violated all the time is your the only one that should handle your physical card. the business should never touch it.