This is much more difficult to answer. The answer is yes. The only people who know that answer are the criminals. I think that people focus on the Internet and ignore all the other ways that they hand over their credit card numbers. For example, people do not give a second thought to giving out their card number while they are on a cordless telephone.
Scanners are widely available that can intercept cordless and cellular telephone calls.
Also, many people throw away their credit card receipts in the trash, allowing any dumpster diver to get all the information they need to abuse the card. Yes, someone can eventually crack the code, but if they can do this, they would probably target more valuable information than a single credit card number. People wonder about the security of transmitting a credit card number, but do not worry about the processing and storage of the number on the other end. A criminal with minimal intelligence would focus on compromising servers collecting and storing thousands of credit card numbers instead of worrying about searching through millions of Internet messages with the hopes of finding a single unencrypted credit card number. This, to me, is the most troubling aspect of Internet commerce.