I know on UA, they will sometimes do this. However, they also put a sentence or two, in red so its hard to miss, when they email out the itin that the credit card used for the purchase must be shown at check in. If not, the pax will need to buy a new ticket in order to travel.

Happened to me once years ago, and it is a CC fraud thing. In reality, you can bring the CC to the airport at any time prior to travel and an agent can clear the flag. Also, at least at UA, once its cleared, it is good for the itin, so it isn't asked for on the return.

Not sure what the algorithm is for determining who gets this, but seems to me a start would be if the name of the passenger, particularly the last name, doesn't match. My guess is if some of the billing info. entered is slightly different (i.e. typo in billing address, etc.), they can still accept the card, but may do something like this for verification.