You are asking why the card number and the security code are printed on the card. In both cases, let's review a bit of history:
The card number
The card number (called PAN in the industry) is just an identifier, it has no reason to be secret. It is needed for any transaction, so that a charge can be... charged back to the relevant account, whether:
- at a physical point of sale (POS), using the old "imprinter" method (not sure if that's still in use anywhere). That's the reason the number is actually embossed, not just printed (along with the other details required for the transaction: expiry date, name of cardholder).
at a point of sale, using a POS terminal ("credit card machine"), which either reads the magnetic stripe or the chip of the card, which both provide the PAN and the rest of the data without any authentification or encryption.
by phone or paper (what is known as "MOTO" in the industry: mail order / telephone order), when you just read the details over the phone or write them on the order form.
on the internet, where you need to read the number off your card and enter it into a form. How could you order anything if you can't read the card number?
The PAN has never been considered a secret. It's just an account number, exactly like your account number appears on paper cheques, to know what account the money should be taken from.
Some people think the key (the last digit) is a (poor) security feature, while it's actually only used to protect against input errors (digit changed, digits swapped...).
Nowadays, people start to think that a PAN should be secret, and this has led to the introduction of "tokenisation": instead of sending the actual card number, another card number is sent instead, which is either limited to a specific channel (and possibly device), or even to a single transaction.
This is the case for instance for Apple Pay: when you register your card with its real PAN, the bank sends back a token ("fake" PAN) which is used instead, and can only be used for payments made with Apple Pay on that device. If ever someone intercepted that PAN, they wouldn't be able to do anything with it: it won't be accepted to add a card to Apple Pay, won't be accepted in store, online, over the phone, or anywhere else.
Is that really useful? In a perfect world where all transactions are authenticated by other means, it really shouldn't matter, a PAN by itself should be useless. In practice, as there are channels that allow the use of pretty insecure authentication methods, that's an additional line of defence.
Note that the need for tokenisation is probably slightly more important with the introduction of contactless: you can read the PAN of any contactless card without even touching it, it's just a matter of getting close enough.
The security code
The security code printed on the back of the card (or on the front, for American Express cards) was not originally present. It was added to avoid the following fraud scenarios:
a credit card receipt with the full card number (and name and expiry) was discarded and collected by someone else (this was especially true when imprinters were in use, but was also true before the card networks finally decided it was forbidden to print the full PAN on the customer receipt).
a card is "swiped" to record the contents of the magnetic stripe, which contains the PAN, expiry, cardholder name, and more...). This allowed people who had physical access to cards (waiters, cashiers...) to record large numbers of cards pretty quickly without being noticed.
To counter this, this new code was added, which is not on the receipt (as it's not embossed), and is not on the magnetic track either.
This code is required only for MOTO and online purchases, where you cannot see if the user actually has the card (a so-called "card not present" transaction), and you want to be a bit more sure that the user has the card.
This is indeed quite easy to circumvent: you just need to either make a full copy of the card (both sides) or make a note of all the data. But in many of the scenarios above, that made it just a bit more difficult for a dishonest user to do it without being noticed.
(The introduction of hand-held terminals also helps a lot, as a user can keep his eyes -- and hands -- on the card at all times, but especially in restaurants in the US, this is not yet standard practice).
The security code also helps in the case a site stores your credit card data, and someone manages to get access to it: in theory, no-one is allowed to store the security code, so a hacker would only get the PAN and expiry, and would not be able to use it again, but, in practice, way too many people still store the security code. The industry is chasing after those (it's one of the aspects of the PCI DSS initiative), but there's still a long way to go.
The real protection comes from new authentication measures (3D Secure) that allow another mode of verification beyond just that data. Depending on the bank (or even the card), they could involve:
- a password
- a one-time password (OTP) sent via SMS or other means
- biometric authentication (fingerprint, face recognition, iris scan...)
- actually talking to the chip on the card by use of the card reader connected to your computer (I'm not sure this has actually been deployed anywhere)
...
Note that the security code is used only for online/MOTO transactions ("card not present" transactions). Card present transactions will either use:
- another security code which is on the magnetic stripe (though this is easy to copy)
- communication with the chip (on cards that have one) so that the card authenticates itself.
