This type of scam is all over the place now. Especially by smaller stores.

Here's one: https://support.nastydress.com/faq/faq/view?id=1162
And another: https://support.everbuying.net/faq/faq/view?id=1459
And another: http://www.gearbest.com/about/verify-payment.html

You are correct. They are not allowed to do this. Obtaining this information does not help to 'verify' an order. Which is why it looks like a scam, smells like a scam..