Normally, that authorization check would catch a software-generated number. Some overseas banks, particularly in Eastern Europe, run these simple authorizations for even bigger purchases. The first six numbers of any credit card are the BIN, for bank identification number. It's easy enough to generate bogus numbers for banks with lax stand-in thresholds. The Web also solves another problem for would-be criminals.
Banks can catch credit card crooks by tracing the shipping address for goods like CDs or books.
But there's no such protection for downloads of software, music, or subscriptions. Even authorizations that check addresses are no protection against fraud originating overseas. Out of the US, there's no help. That's a serious problem for a global e-commerce network. The fraudsters know it.