[StripeCardholder] Omit international phone numbers from Stripe

> [!NOTE]
> This issue has been assigned to @ArushYadlapati

## the problem

It has been reported by some HCB users that they don't receive 3D Secure SMS verification codes. Here's my report to Stripe support:

> We're receiving an increasing number of reports that our Stripe Issuing Cardholders are not receiving 3D Secure verification codes via SMS when making online purchases. To clarify, we're experiencing this when Stripe Issuing Cardholders attempt an Authorization on their Stripe Issuing Card—this is not related to collecting Stripe Payments.
>
> I am having a hard time identifying the root cause. However, given that the 3D Secure process is completely handled on Stripe's end, and our codebase is not involved in the process, I thought it would be best to reach out to you.
>
> Here's an example. During the checkout process on a merchant's website, our Stripe Cardholder is presented with the following 3D Secure screen. The code is never delivered, regardless of how many times "Request new code" is clicked.

After a thread with Stripe support, I'm learning that Stripe Issuing will attempt SMS verification on phone numbers guaranteed to be undeliverable. Stripe is only able to deliver to US (+1) and GB (+44) country codes.

> After reviewing the situation, I can confirm that there are geographic limitations on 3D Secure SMS delivery:
>
> - SMS verification codes are only delivered to phone numbers in the US and GB.
> - Any attempts to send codes to phone numbers in other countries will not be delivered.
> - Similarly, cardholders physically located outside these supported countries may not receive codes.

I then asked about their fallback logic when a phone number is undeliverable. It turns out they will always attempt SMS verification when a phone number is present, and once it fails (guarenteed for non-US/GB phone numbers), the fraud check is stuck in an "undelivered" state with no email fallback. Email fallback only happens when no phone number exists for the cardholder.

> I understand your inquiry about 3D Secure verification methods for cardholders with international phone numbers.
>
> To directly answer your question: For cardholders with phone numbers outside the US (+1) and GB (+44), Stripe does not automatically attempt 3D Secure verification through alternative methods like email. The system will attempt SMS delivery to these unsupported country codes, which will result in an "undeliverable" status in the Authorization object.
>
> For US cardholders specifically:
>
> - When both phone and email are on file, the phone number is prioritized.
> - If only email is available, that will be used for authentication.
> - This email fallback only works for US cardholders.
>
> For cardholders with non-US/non-GB phone numbers, the 3DS verification will simply fail with the "undeliverable" status rather than attempting delivery through alternative channels.
>
> If you're encountering this issue frequently with your international cardholders, you may want to consider advising them to update their contact information with US or GB phone numbers when possible.

_**Note:**_ All of our cardholders are US, although they may use non-US phone numbers.

## the proposed solution

Well, first, I'm trying to get Stripe to handle the fallback on their end.

> That is helpful information!
>
> I would like to provide some feedback. I would prefer Stripe to automatically fallback to email when it detects an undeliverable phone number. With the current system, Stripe attempts SMS delivery that is guaranteed to fail, making the card unusable when the merchant requests 3D Secure.
>
> Example of desired behavior:
> 1. A US cardholder with a non-US/GB phone number attempts an authorization that triggers 3D Secure.
> 2. Stripe notices their phone number is undeliverable (non-US/GB country code).
> 3. Stripe falls back to email without attempting SMS.
>
> With the current system, our (undesireable) workaround to keep cards working is to:
> - Encourage cardholders to use a US or GB phone number.
> - If a cardholder does not have a US or GB phone number, then we will not provide that phone number to Stripe. This allows Stripe to fallback to email for 3D Secure.
>
> The current system puts the burden of the fallback logic on us (the API consumer) when it should be handled within Stripe.
>
> Please let me know if I've misunderstood anything.

However, if there's no movement there, we may need to implement the workaround I mentioned above.