Another mistake:

> The data they took with the attempt of purchase is the card is still usable (not cancelled)

The payment flows should not distinguish between a nonexistent card, a cancelled card, and a valid card that needs 3D Secure. I bet the banks could even implement that without any cooperation on the part of the merchants.