I've recently been approached by a person asking me for a donation to Save The Children. while I was inclined to donate, I didn't because they were asking my full name, 16 digits of credit card and expiration date to fill a form.
They said that they can do nothing wrong with my credit card information without the security code, but I'm not that sure, since security codes are only 3 digits (1000 possible combinations), even when payment processors block you after 10 failed attempts (that's the number I found after a quick search) that's still 1% chance of an attacker guessing your security code by brute force (Even more for VISA cards that don't count failed attempts from different sources made at the same time).
So what other attack vectors or risks exist (apart from the brute force attack) when someone gives up this kind of information to a stranger in the street?
