It's definitely not required, but it gives you a much better case if someone files a unauthorized chargeback. If you used AVS (Address Verification System) or t

It's definitely not required, but it gives you a much better case if someone files a unauthorized chargeback. If you used AVS (Address Verification System) or the CVV number, you can in a sense prove that the person who made the purchase was the cardholder. 37Signals, and OrangeSlyce (my company) use Braintree which provides a VERY innovate solution called "Transparent Redirect". It allows you to accept credit cards directly on your site, with your domain, but the form posts directly to Braintree, and transparently redirects back to your site so the customer never leaves your domain. It's very cool stuff and I don't know of any other merchants that offer this. Most importantly, the CC data never even enters your environment.