Is this person wanting to pay my credit card trying to defraud me?

This is no friend. The clue is that your user name and password aren't required.

I've made payments for my mother in law, and the card number, just the 16 digits on front, were enough to send a payment. No one writes their username and password on a check when they make a payment. Think about that.

That's what "friend" means.

The very definition of a friend is someone who knows you well, you know well, can be presumed to help you move**, and would never rip you off.

If you are not properly using the word "friend", stop! Language is the shared medium by which we communicate. It only works if we share meanings. If you say "friend", we have to take that at face value, based on the common meaning. (mind you: some nasty people manipulate/condition others to use words that don't fit. If someone asks you to use words like "friend", then scam alert.)

So, assuming it's legit...

They have no use whatsoever for your password or any of your details, and that's fishy. If they really want to pay your bill, all they need is a copy of your payment slip - you know, the tear-off section of the first page of your paper or PDF bill. That doesn't even have your account number on it. The most gracious interpretation is they are XY'ing: confusing the desired task with a particular way to do that task.

Social media sites don't help at all, using words like "friend" to mean nothing but the most tenuous connection. We also see people use the word "girlfriend" to describe someone they have only known by text message, and have never heard their voice, do not know their last name, and are actually being catfished for money. We see it everyday on travel.se.

** A friend will help you move.
A real friend will help you move a body.
But the truest friend will help you move BOOKS.

Your friend has unwittingly got a virus/malware on his computer which has read his contacts list and sent some or all of his contacts (including you) a message, pretending to be from him, asking you for these details. Don't break off the friendship, because he didn't do this deliberately; but don't send the information, because it won't go to him, it will go to the people controlling the malware that hijacked his computer, who will promptly drain your credit card account.

The information your friend asked for is not necessary for fixing your payment related problems but having all information can actually create even bigger problem. So be careful with this scenario.

First of all did you really have problems and need help? How do your friend know paying on behalf of you will clear your problem. What is the way he asked this information? Over phone? Personally? By Email or other electronic means of communication? When did you last meet your friends face to face? Do you have any kind of financial transaction with your friend in past?

With other common sense about financial transaction and friendship in modern society there are many different ways to ends up this.

If you want me to positive about your friend any of description might match:-

1. You shared your financial problems with that friend or some way get to know that you need him and help you.
2. He really wants to pay your debts and his poor knowledge on hazards he just placed himself on your place and asked your information to pay.
3. According to his poor understanding on consequences he just asked ALL INFORMATION of your cards, never give second thoughts on sensitive information which should not shared by any means. Even to a bank issued those security features. Lots of people think as bank know all the information of cards they issued. There's valid reasons for issuers knows issued information. Like you create your Wi-Fi password and without knowing that how you can share. Unfortunately Banks are not operated like way your Wi-Fi system works.

If I came out from positive and reality in mind, just deny taking helps from your friend and carefully continue your life forward.

There are some other things a good friend should consider on such events, Did he/she information personally or remotely? If remote request was made for information immediately information him about it and ask for explain why those information needed just to bring you out from problem. Tell him people need that to create problems not to fix.

You should actually talk with him directly as to confirm that he is safe and not asking you for information on behalf of other party using him in middle ether by force or by technically.

Be safe. And NEVER SHARE YOUR SECURITY INFORMATION WITH ANYONE EVEN WITH BANKING STAFF MEMBERS.