[kdomanski]

tl;dr: During account recovery, iCloud might ask you for the details of a credit card you’ve been using with the account. But it doesn’t just check whether the data matches their records — it tries to actually run the card. And if the live check is rejected by your payment processor for some reason then it doesn’t matter that you got all the card’s details right.

[toomuchtodo]

It’s using your financial services company as identity proofing. If you have a card that matches your name with the CVV, it is very likely you are you.