I know it's been a few days, but, just wanted to add that this is a good point, and a part of what I meant with not using VbV lightly. There are valid reasons to use it, but frankly, it should be close to the last thing you implement.

The only times I've used it where when offering a b2b product/service where fraud was a real fraud.