Card authorisation, ID check - always?