I did the math and ended up deciding the slightly greater return from Option 2 was not worth the trouble of providing a bunch of active credit card numbers to an unknown server. So I opted for Option 1 and provided a single account number which was used for foreign transactions and has since been closed. Whatever information you choose to provide will likely live on in perpetuity on some server somewhere. And any breaches of the server will likely take a while to be reported to affected individuals. It's just not worth it to me.