I'm currently building a site where a user can sign up, and amongst other things, opt-in to a paid subscription for a selection of products. Currently, my workflow has the following steps:
- Sign up (providing name, contact, etc)
- Confirm account (via email/SMS)
- (Optionally, maybe later) Opt-in to a subscription, requiring address and credit card details.
Since the primary goal is to have people pay for subscriptions, I'm putting together a streamlined on-boarding workflow that creates the user's account, asks for address and payment details, and subscribes them, all in one process.
My question is, should I allow an unconfirmed user (who hasn't confirmed either their email or phone number) to store credit card details against their account? Instinctively I feel like having a confirmed account should come first, but I can't pin-point why exactly. It's definitely worse for the speed and simplicity of the sign up process, so if I can avoid blocking on confirmation, I'd like to.
Are there any security considerations around doing this? (I'm already using PCI compliant payment provider - so I specifically mean attaching a payment token to an unconfirmed user).