merchants must ensure that it is not a stolen account, with an ID you cannot do anything