merchants must ensure that it is not a stolen account, with an ID nothing can be done