|
The software needs to not do that. Server-side form validation needs to be completed *before* the card authorization is run. If there is a problem with the form entries, the user should be returned to the form without any authorizations executed. Only after all other inputs are validated (including an algorithmic check of the cc number), then you do the authorization.
|