That's the most common form of credit card fraud. It's called "skimming." The wait staff (or front desk person at a hotel) carries a little card reader and swipes your card when noone is looking. The card reader captures all of the information from the magnetic stripe on the back of your card. That information is then sold to a credit card fraud ring and is encoded either to blank media or stolen credit cards which have been canceled by the owner.
When a store's POS system requires the entry of the last 4 digits of your credit card number, or you are asked for the 3-digit number on the back of the card, the merchant is trying to protect against "skimming." If skimmed information is encoded on a mag stripe, it will not match the original number embossed on the card. The 3 digit security code is not contained on the mag stripe and a crook's guess would almost certainly be incorrect.
We always want to come up with the most sophisticated plots (hacking, etc.) and everyone worries about using credit cards shopping on the Internet. But the truth is the riskiest transaction you will ever do with your card is pay for dinner or a bar bill. That is where most cards are compromised.
New York City is sort of the intergallactic capital of credit card fraud, but Florida and London usually fight for second. Almost all credit card fraud in Florida is done either in Orlando or Miami, so WDW is certainly a hotbed for that kind of fraud.