I turned on notifications for my CC's so that I receive an email whenever a transaction is made that is greater than $1. What I acually receive is an email when there is an authorization, which means that I see the authorization amount in most cases. Sometimes this is different than the actual amount debited from my account. For instance, when pumping gas I will receive an email indicating a charge for $50-$150 (I believe this is while I'm still pumping). The actual charge must get amended at some point because the CC web interface shows the amount reflected on the gas pump. I've seen similar elsewhere. My guess is that these kind of authorizations, charges, and amendments are likely very common and handled automatically by the payment processors or back-end systems. I believe being able to amend a charge would address the concern about delays between authorization and the charge itself.
Also, reoccurring charges are handled differently than a one time charge and don't actually use the CCV2 (at least not past initial authorization). I've had my CCV2 change (due to a changed card) and reoccurring charges continue to work just fine.
I also get email notifications from Chase when my credit cards or debit card is used. For gas I just get, "As you requested, we are notifying you of a gas station charge. This charge was authorized at xxxxxxxxxxx #xxxx on {date} {time}." No dollar amount. At restaurants the email displays the "pre-tip" total. I don't receive follow-up emails with actual dollar amounts of gas bought or total restaurant "meal+tip" totals. Other purchases actually list dollar amount in the email.
Regardless, what you said about the chain of events from authorizations to actual charges makes sense and shouldn't be a problem for a CC with revolving security codes. You are correct about reoccurring charges, forgot about how those work.
Every system I've seen like this has a rolling window. Frequently the previous code doesn't stop working until the completion of the next window.
So the current code AND last code are both valid. When a newer code is generated, the "current" code becomes the old code that still works, while the old old code drops off. That would prevent many problems with code changes during authorizations, etc. Did not knot that. Thanks.
