Alright, I solved it. The little 12-year-old boys in Tech Support at Authorize.net were wrong - I'd asked them if I'd messed things up when I was playing around on the site a few days before - I remember idly configuring their website's payment form (totally separate from my OS Commerce payment form) and checking "required" for the security code just to see what it looked like. Well, there were TWO places to check that the security code was required, and I'd gone back and unchecked just the one when the website started throwing the error, and little Timmy at Authorize.net Tech Support (Mom, make Josh quit hitting me! May I help you, ma'am?) said the settings were correct to not require a security code, and anyway, settings on the payment form on their website, which I wasn't using, wouldn't affect the settings on MY site. Well, Little Timmy was wrong all round.
Anyway, I went back and checked for myself when I couldn't find another reason for the error to save my life, and sure enough, there it was, checked! Unchecked it their on THEIR payment form and everything's fine on me website.
Just thought I'd pass along the experience!
Francine