It can't be anything less than fraud - (though the Obamessiah will just throw his web guys under the bus, and not return the money until after the election ) though I have no facility for taking credit card payments directly (my web business doesn't have enough clients to justify the additional expense) I have setup payment gateways for others. Other than the CVV number requirement, name/address verification is setup as on by default. And as the article suggests, it needs to be manually disabled to allow this to happen. (the only reason to do this BTW is for some international transactions, and even that is a marginal excuse - especially considering that the campaign shouldn't be taking any foreign money)