I am needing an extension that will not charge a customer's card until we have manually approved the order.
It is difficult, however you can resolve your problem by refund the money to the customer if that is a invalid order.
This wouldn't be a good option because they would have to pay the credit card fees still on them. These are high dollar items.
The only way that I know of is to to do it offline authorization. If you do it this way you can't ask for the 3 digit code in the back or 4 digit if Amex in front this is not PCI compliant. Also once you authorize card you must delete it off database. If you want to do it this way make sure your server is up to date and do a PCI compliant scan. I think you can also do it another way by just using a payment gateway and that only authorizes the card not charge it. I am not sure though that can be done easily or cheap. I am looking at this option as well. I think I am going offline processing and if I need security code I was just call customer to make sure the order is correct, etc. It's a pain this way though.