They could if they wanted.
It's of course illegal to do if you didn't authorize it, and to process credit cards, they need to have a relationship with a credit card processing company, which is not so easy to fake - not any Joe could do that using a fake ID.
Note that you are protected through your credit card company; if you tell them it's an unauthorized charge, they'll return it to you without discussion. It is then the vendor's duty to prove that it was authorized, and if he cannot, he'll pay extra fees to the processing company.
Overall, the risk is very small; it shouldn't be your worry.