by being the card issuer that issued the card to him. data protection prohibits anything else, for legal reasons. and how would you be sure he's who he says he is, anyway?
you can also carry out reasonable authorization checks, depending on what country you are in, such as the CV2 number, and the address details. but to do all this, you need a merchant account with a bank, an EFT engine and a lot of money. the guy sat at home can't really do it. use an online payments service such as worldpay, they'll take care of that sort of thing for you
> Even though you can't do a full test, you can do a
> 'luhn' test -
> http://en.wikipedia.org/wiki/Luhn_algorithm . This
> will tell you if it is worth taking any further.
and if you need an easy test number to test your luhn routine, '4' follwed by 14 zeros followed by a '2' is an easy visa card to remember. there's bound to be loads of luhn-checking libraries around, have a search before writing it yourself