You can prevent a lot of fraud by simply requiring both a postal code and the CVV on the card. It's unlikely that a card thief has both pieces of data. (If you steal the physical card, you won't have the postal code, if you buy a database of cards, unlikely that they will have CVV's)