Another mistake: > The data they took with the attempt of purchase is the card is still usable (not cancelled) The payment flows should not distinguish betwee

Another mistake: > The data they took with the attempt of purchase is the card is still usable (not cancelled) The payment flows should not distinguish between a nonexistent card, a cancelled card, and a valid card that needs 3D Secure. I bet the banks could even implement that without any cooperation on the part of the merchants.