Welcome to WebmasterWorld Guest from 220.127.116.11
The online business was still able to withdraw funds from my account without me giving them the new expiration date.
Do business not have to use the expiration date when requesting funds from the bank?
I'm the CTO of a virtual credit-card company, and so I should really know, but let me guess instead... B^>
The individual banks' machines attached to (say) VISANet for a VISA debit card seem to be able opt to make some information available and/or opt to check/not some information when a debit/auth request is presented to them.
For example, not all banks' systems check the CVV (the 3-digit number on the back of your card) even if the merchant collected it from the user and presented it to the card issuer. I know, because as a test I deliberately fed through our system a bad CVV (for my own card with another provider) and the the issuer of my card accepted the transaction! (In this case the transaction was entirely genuine, but if it had not been then the card issuer should be liable for any losses.) We had had problems with this other bank and we needed to see where the fault lay...
Thus expiry dates may well be treated the same, especially if there is no separate issue number on the card...