When a file is uploaded, it gets assigned a temporary name in the $_FILES array. I don't know the exact lifespan of those files, but you might be able to capture that name in the session and put off the move_uploaded_file() call until after the CC is verified.