Once you give them, the operator, that number of your card plus exp date and cvv you lose control of it.
Usually portals are okay but look closely for a clear statement that this is a one time transaction. I would screen cap it too.
Legally they can only charge what you authorized but that has never stopped a collection company from trying to charge your card multiple times.
If one does, the dispute is on you to prove with your bank and when they deny you its up to you to sue and pay the costs of a years long lawsuit.
If I were you, I would get their agreement to payoff amount in writing, even email is binding if from their Corp domain, and I would demand their wire transfer info and then pay whatever fees my bank charges for the wire transfer.
In the alternative, I would call my bank and see how they handle Bill Pay. Many systems have the bank mail paper checks.
A 3rd alternative is getting the payoff agreement letter or email along with corporate mail address and department name and Overnight bank certified counter checks .send them return receipt required and insured.
Overnight certified mail is 10 or 20 bucks. We'll worth it to get a signed receipt. If they claim they never got it I guarantee the Post Office will criminally investigate them when you file the insurance claim and report to the Pist Master General that a signed insured package disappeared.
The last thing I would ever give a debt collector is any path to accessing my bank account or debit card/credit card accounts. I don't trust them
