As long as you have the card number and expiration date, you can buy online by mail order. For users, the validity period of the credit card is confidential, so don't disclose it to others casually. In this mail order mode, the password is unnecessary.

If you provide the website with the card number and expiration date, it is equivalent to allowing and authorizing them to transfer money to your credit card. As long as the card number and validity period you provide are correct, your issuing bank will be regarded as valid authorization.