There are two facets to this question:
- Is is possible for a merchant to charge your credit card without your authorization?
- Is it legitimate for a merchant to charge your credit card without your authorization?
Yes, a Merchant can technically charge your credit card without your authorization but, No, that would not be a legitimate transaction. It would be one form form of credit card fraud. Cardholder can file a claim with Issuer Bank to have the charge reversed.
As for how it’s technically possible for a Merchant to charge your credit card without your authorization, one of the (perfectly legitimate) ways is to use the so-called MOTO mode. Standing for Mail Order Telephone Order, this mode is supported virtually all over the world, including in countries like India which ostensibly require PIN or CVV or OTP or some form of two factor authentication (2FA) for all credit card payments.
PSA: Catalog Shopping never took off in India but the enabling MOTO mode for processing credit cards works on Indian POS machines. Used by magazines, coworking offices, et al, Mail Order Telephone Order processes payments with Card # & Expiry Date – no need for Name or PIN/CVV. pic.twitter.com/HoL6LYuKMP
— Ketharaman Swaminathan (@s_ketharaman) December 5, 2018
As for why credit card rail is built this way, the reason harkens back to the raison d’être of credit card. When credit cards were invented, they were meant to replace cash by being as easy to use as cash. If, in the process of fulfilling that goal, a credit card is used fraudulently, the Issuer bank is required to reverse the charge, no questions asked. But many cardholders don’t know this and get fooled. More at Ketharaman Swaminathan’s answer to Which is more secure, Visa or Mastercard?.
Thankfully, all that’s changing now.