Fair enough. "Yet." I've also noticed the same pattern with compromised cards: a couple of small auths to test the waters, and then increasingly large charges

Fair enough. "Yet." I've also noticed the same pattern with compromised cards: a couple of small auths to test the waters, and then increasingly large charges coming from decreasingly likely places. I regularly log onto my online banking and inspect the recent activity looking for exactly that kind of activity. I've long wished for the same, "whitelist-only card" type thing, too. I think I might smell an opportunity...