You aren't paranoid - I would consider that out of line as well for anyone. Well, except maybe for BF.
Credit card merchants aren't supposed to do things like that. They can get their merchant facility revoked. Its no different than when they ask for photo ID when you use a credit card.
http://www.privacyrights.org/fs/fs15-mt.htm