AA working with ****mers

My mother who is a pensioner, is using the services of AA for the vehicle and on the 6th of March she called in to update her banking details, she spoke to a man by the name of Thabo, who then requested the 16 digit bank card number, which she provided and proceeded to request her CVV number, which she refused to give. Now my question is, if calls are recorded how does a consultant request such information from a client, surely he represents the company. After she refused to give him the CVV he just told her that the payment would go through on the 15th and didn't request any further information. This is pure ******** behavior, so disappointing.