Pretty sure some merchants also ask for billing address, name on card, and phone number.

All this fails if the bank flags the transaction and requires 2fa.