As a brief bit of background: these charges are accepted because card brands do not always decline if the CVC fails (and AVS has no effect); instead, they're taking several signals into account. We expose as much data as possible to give you full control (https://answers.stripe.com/questions/what-controls-for-fraud...).

That said, I really appreciate the feedback. We're actively working on better fraud controls that should be ready soon!