...
A: See the upsell page for details. Short answer: They're still charged. If the receipt page is not shown within 45 minutes of collecting payment information, the order is processed. This covers upsell-rage-quit (which happens when you annoy the customer with too many upsells) or accidental browser closing.
CVV2 and Accounts Receivable
Q: When an order is declined what happens to the CVV2 Code?
A: As part of PCI compliance, we can never database the CVV2 value. If you send an order to Accounts Receivable for decline, fraud review, etc. you'll either have to contact the customer to obtain the CVV2 value over the phone or configure your payment gateway to allow charges without the CVV2.