[azernik]

If as a merchant you want something that works now, you can use Stripe - send identifying credit card info directly to Stripe without holding on to it yourself, and then ask it for a persistent customer ID that you can repeatedly charge.

You could still retrieve some identifying information through their API, but if you keep your account credentials somewhere separate from your database it's less likely for an attacker to get both.