METHOD: Login and change the account details. Proceed to select your favorite hotel/stay and place the order. No CVV required. Make sure to mail bomb so victim doesn't notices you placed the order.
You can book a room and write your own guest details so you won't have issues.
Warranty for invalid login, missing card/expired or 2FA.