Question about handling credit cards

I'm looking at online stores and it seems like a lot of them maintain copies of credit card numbers. Is this true? That seems like a "bad thing" to me, especially in terms of liability and risk of hackers. On the flip side, it seems like there are legitimate reasons. For example, if you bill the customer when products ship, rather than when the order is received. Or, if the customer decides to have instock items ship now and back ordered items ship when they arrive - which results in two shipping charges. How do you guys handle this? -Ed