What kind of business writes down credit card numbers (even without CVV)?

Online payments (e.g. e-commerce) usually send such data directly to the PSP, or encrypt it with a PSP controlled key.

And in person payments (e.g. stores and restaurants) use a payment terminal/device, which is presumably PCI DSS compliant and doesn't store such information.