With any card processor you simply generate two random small amounts, remember those with the customer account, and auth those amounts with the card processor.

With any card processor you simply generate two random small amounts, remember those with the customer account, and auth those amounts with the card processor. Then ask the customer to enter the two amounts (from looking at their card transactions online or in their card app). You never generate a sale against those auths, so they expire and the customer doesn’t get charged. There’s nothing special about the auths, this is how card authorizations always work.