I don't think you can ever be too paranoid about ordering on line.  My wife does 90% of her shopping on line now but for every purchase she logs on to Mastercard and gets a one time card number for just that purchase. 

It may be that because they're a smaller dealer, they may have to manually do credit card transactions via telephone.  The phone number on the back of the card is information that is publicly accessible; it's probably just more convenient for them to ask for it than to look it up every time.  They very well may run the number by the bank to ensure that i hasn't been flagged for unusual activity or reported as stolen.  There's quite a few possibilities, but I would say that the bank phone number request itself shouldn't raise any flags for you, but if there's anything else that doesn't seem normal, then look elsewhere.  See if they'll do a paypal transaction instead, so that you don't have to give out any information directly to them.