> the only way to release them is for the merchant to call the customer's bank and provide the, cc number and auth code.

Who is your payment processor? They should be voiding the auth after the AVS or CVV mismatch.