On 2/27, I made an online purchase, and used my freshly-issued replacement debit card. I accidentally put in the wrong expiration date and security codes, and the first time the transaction was refused. On the second attempt, I put in a different code (also accidentally, I used the 4-digit code from my AMEX card), and I also put in an incorrect expiration date. This time the card went thru.
I noticed afterwards that I had the wrong date and code, but it didn't matter. Purchase made, account charged.
Why have these dates and codes, if they aren't part of the security check?
P.S. Both charges appeared on my paypal account, even though the vendor refused the first one, so there was no security checking at all on the paypal end.
