[tzs]

All that is actually required to charge a credit card is knowing the card number. (Some people think the expiration date is required, but it is not. The expiration date is only checked at the payment processor, and there it is just a simple check that it is in the future. You can just make up any future date when submitting the card and it will work).

However, when submitting the card you can supply name, address, and CSC (and maybe telephone number?) and ask the processor to check those. Those will be checked against what the card company has on file.

Details vary between payment processors, but all will have a way for you to bail out of charging the card if you don't get matches on a subset of those fields you chose.

Like most things with credit cards, those checks aren't free. If you are using a payment processor where you see all the little fees it will cost you a tiny amount to do the checks, but if you are with one of the processors that bundles it all together into tiers the fees for checking will almost always not be enough to bump a given charge up into the next tier.

The only real downside of doing the checks is that the more data you make the customer enter, the higher the chance they will not complete the purchase. If you are doing something that has an extraordinarily low chance of attracting people who are using stolen cards and the transaction isn't for a very large amount it might be worth it to not do the checks.

For everything else, you should do the checks and if things don't check out do not accept the card.

[patrakov]

> The expiration date is only checked at the payment processor, and there it is just a simple check that it is in the future

Wrong, at least for Raiffeisen Bank in Russia. Once I called their support why the payment didn't go through. Their answer: "you made a typo in the expiration date, try again" (and it worked).

[ratww]

Yeah, great point. There's lots of assumptions here from American posters.

This depends heavily on the country where the processing is being made and in the bank that issued the card to the customer. The data is (in the cases I saw) passed down to the card issuer via an API and the issuer gets to decide what to do.

In Europe for example, CVV seems to be required, except when the merchant requests an exception, or when a pre-auth token is used. In Brazil I've had my card rejected because of a typo in my name, although "forgetting" the middle name was alright.

It's not as clear cut and as insecure as in America or as people are making it seem here.