A user scans a payment card while setting up an account on a merchant's website, or while completing a check out to purchase an item or service for the first time. The subject system stores signals from the card scan (e.g., device ID, verified card, location, last time scanned and used, etc.). The next time a transaction is requested for the card at another merchant, the subject system can reference the last data it has on the card. If the transaction is being requested from the same device or a reasonably close physical location within a reasonable timeframe, the subject system can be highly confident that this is a legitimate transaction, without requiring the customer to scan their payment card again.