Usually your name, another credit card or debit card number (and sometimes its expiration date and CVC number unique to that card). Pretty similar to what you'd put in a web form, or manually enter into a card reader machine if the card's magnetic stripe or chip isn't being read properly.
Usually it can. The person I was replying to asked how someone would pay over the phone, not why. I agree it was an oversight by Apple not to allow online payments.
