When a fraudulent credit card CNP (Card Not Present) transaction is made, merchant is liable for the chargeback.
For that reason, our company implemented a policy where we ask a photo of customer's card only showing the last 4 digits before we clear the payment. We ask them to send it via email which I think is a security risk because it could be unencrypted.
Our company provides electronically delivered financial services. So we only ask for billing address, we never deliver physical goods.
What's the better approach of verifying card ownership? (complying to PCI-DSS)