Hard to say, I just recently placed an order with tiger but did it online with paypal. Not a phone or credit order. Typically they only need to see the last 4 so long as they know what card it is, mc/visa usually start with the same 3 sets of numbers and only the 4th set is what differentiates one account from the next. So long as you spoke with a manager after calling them directly and they verified it's a practice they use it could very well be legit. Hate to be paranoid, but it's the holiday season and scammers are in full force around this time of year.
Better safe than sorry. Years ago had a significant other click on an email link to verify some online purchase - the next day I went to use my bank card, the account was cleaned out. Thankfully the bank got on it right away. I'm in the u.s. and in 24hrs the account had been accessed in 5 different countries in europe. Took about a week to get the funds replaced, not fun at all.