A traditional method used was to send two very small random payments, say 0.03 and 0.09 to the card in question, then ask the caller to confirm the payment details, how much etc, once they'd arrived. If they could provide these details that is pretty much as far as they can go in terms of verification.