No. Any website needs you to enter your CVV number and PIN to authorise a transaction. So your friend cannot do anything by just noting the card number.