I had the same shock just today as well.
I applied for a supplementary card for the wifey and was asking her to activate her card upon receiving it today. She could not do so via SMS from her mobile number.
That's when I realised I needed to activate it thru the principal card, my mobile number. So, being surprised and confused, I called the CS line.
Indeed, the CSO confirmed it was the same 16-digit card number as mine, even down to the CVV2 Code!
I was flabbergasted!
CSO insisted they could detect fraud. I wanted them to give me a letter or email in writing and thinking twice about putting my money with the bank!