Was Foxtons right to request my card details be sent by email?

My previous apartment was rented through Foxtons and when it came time to move out and get the deposit back, they asked me for my card details (number and expiry date). I asked if I could give it over the phone, but they said they needed it on file (and for another team to actually process it).

Firstly, is this standard practice? Secondly, would anyone be able to make a debit against my account without the 3-digit CVV on the back of the card?