They could require the CVV when delivering to a new address - it's only three digits. But we're talking about a company that doesn't even refund obviously fraudulent transactions, so never mind.