Probably meant sending the payment details without tokenization, which in practice means sending a merchant-specific (in case of this one, hotel-specific) card details (https://www.emvco.com/emv-technologies/payment-tokenisation/). A lot of hotels, for some reason that I still don't know, are still relying on MOTO methods to process payments, and MOTO requires the whole card number/PAN, name on file, expiry, and CVV to be sent (which I encounter from-time-to-time because my non-MOTO Mastercard is being rejected for being too weird). Combine that with the fact that US cards don't really enforce 3DS means that you'll have a card number bonanza usable for most American stores.

A)

1. Booking request made, Booking.com holds card details

2. Hotel requests payment

3. Booking.com makes transaction from your card to hotel

B)

1) Booking request made

2) Booking.com requires card details for immediate payment to them

3) Booking.com sends money from their account to hotel

C)

1) Booking request made, Booking.com requires guest identity only

2) Hotel takes payment on arrival