I've bought QR flights for family members on several occasions, some on the QR website and some on other sites, such as Expedia. Neither has ever been asked to show a CC.
The risk is with IROPS: the other day my wife and son were flying MEL-DOH-OTP and the MEL-DOH flight was delayed by ~5 hours, causing a misconnect in DOH. They totally botched the part about notifying us about the situation:
1. My wife got a text about the DOH-OTP flight change, which made it a ridiculous layover.
2. I called and got them to change it back to the original flight.
3. They called ME to tell me that the first flight was delayed and we had to change the connecting flight. I had to dial my wife in because they wouldn't make the change without her approval, even though it was I who bought the ticket.
4. Luckily, we knew another pax on the same flight and it was this other pax who told us that the departure time of the MEL-DOH flight had changed AGAIN. Neither my wife nor I got a message.
5. Nobody was notified of the third change to the departure time; we all found out from the airport website.
In other ways, the situation was handled well but the communication was bad. In case of IROPS you need to be on your toes.