can booking com charge without cvv ?

Pretty sure I sent my wife the front side of my cc and to my wife only, however I got an sms to confirm a trip purchase which I didn't allow after asking my wife. What I wonder is how whoever it is managed to come that far without cvv?