I have over 30 years of experience in investigating Credit Card Fraud and I can tell you, which you may or may not know, that the merchant acquirer that is conducting the collection of credit / debit card for the Obama campaign are responsible for the actions to be taken regarding the Address Verification System responses. The value of the AVS system is that the issuer of the card being used provides back to the merchant acquirer a response based upon the information provided during the authorization process. This response indicates to the merchant acquirer if the card information was validated as to ownership of the account. It is the merchant acquirer that determines what to do when the authorization response is received. In most cases the transaction that comes back with any negative meaning is denied. However, if the merchant acquirer has adjusted their system to accept any response as acceptable the transaction would be completed.
The value of the AVS system is to deny Card Not Present transactions (CNP) which are suspicious. This protects the merchant against charge backs for bad transactions. What is interesting to me is that the merchant acquirer has knowingly violated a basic CNP fraud prevention technique to accommodate a merchant (Obama Campaign). I think that both the Associations (VISA & MasterCard) would be highly interested in looking at the merchant acquirer that was processing these transactions. The value of ignoring the AVS responses is that multiple invalid transactions may be made without fear of being rejected by the authorization systems. This means that the real owner of the credit card account is willing to allow multiple transactions to be made on the account using different names and addresses that under normal conditions would be denied. The merchant acquirer has a complete listing of all transactions done and it would be very interesting to see how many transactions were conducted on the same account number using different names. I would think that this would be a Federal violation under the current campaign funding laws.
You may have mentioned this elsewhere, but disabling the security allows would be credit card thieves to “ping” numbers till they get a hit. The number of “pings” should have raised flags at Visa and MasterCard, don’t you think?
I wonder if they warned the Obama campaign, or worse, ignored it.
In other words, a crook could simply type in random numbers until he found one sequence that worked in some fashion. That could give a thief a starting point for committing credit-card fraud. If all they had to do was type nonsense values for names and addresses, such as Doodad Pro, they could quickly determine which numbers were valid — and they could probably program bots to do that kind of work.