40

A school wants my credit card data including a security code. They've sent me a form to fill in about my card. As I know security code is something that shouldn't be shared publicly. Should I provide it to them?

enter image description here

  • 30
    Are you paying them for something, and using a credit card to do so? Or was this an unexpected request for your information? – yoozer8 Dec 20 '18 at 12:53
  • 5
    It seems to me you might be thinking they are asking for what we call in the UK "a PIN number" because you say it "is something that shouldn't be shared publicly". You definitely shouldn't share the security code you use to pay for items in a shop, or get money out of an ATM, with anyone, ever. But, that's not what they are asking for here. It is a badly worded form, imho, and should make clear that they are asking for the last three digits from the signature strip on the back of the card. If you comply, it'll mean the school can charge your card, but the charge will be recorded. – lukkea Dec 20 '18 at 17:35
  • 1
    Consider editing the institution's name out of the post, then flagging your post asking a moderator for a revision purge. You don't want this institution coming after you for damages to their reputation. – corsiKa Dec 21 '18 at 22:13
  • Probably more than half of all merchants I interact with do this, and nearly all doctor and dentist offices (e.g. when receiving a bill). Similarly to the common practice of prohibiting certain symbols in password fields, I just write it off as inevitable overhead you have to pay to live in today's society. – MooseBoys Dec 21 '18 at 23:30
  • 1
    While the top-voted answers are accurate, they don't answer the obvious question: What can the customer do when faced with such a form? Can a customer report the merchant for doing this? – krubo Dec 22 '18 at 17:50
52

It means that the merchant (here, a university)'s process is to deceive their processor by falsely submitting the charge as a "CVV2 with Magnetic Stripe failure" transaction.

Having the card present during a transaction reduces fraud, so the card issuer and processing network are less likely to incur fraud investigation costs (or even eat the whole charge), and this savings is passed along to the merchant in the form of lower fees.

The merchant is trying to qualify for those lower fees when the card is not actually present at the time of authorization (it's a very high risk situation). In the process, they're putting you at increased risk of fraudulent future charges, and making it more difficult for you to contest those charges (because the thief will have the CVV code which serves as evidence, not incontrovertible, but still strong evidence, of your agreement to the charge).

In the process, they are violating the clear wording of the Visa rules:

enter image description here

enter image description here

  • Comments are not for extended discussion; this conversation has been moved to chat. – JohnFx Dec 23 '18 at 3:40
  • 3
    To summarise my downvote, which I stand by despite other discussion: there are several reasons they might be asking for this information, and even if they are all morally or legally wrong, this answer provides no evidence for its assertion of one specific reason. The answer could be greatly improved by removing the overconfident "this means that..." summary, and listing some of the other possibilities (e.g. misuse of am e-commerce PDQ for convenience). – IMSoP Dec 24 '18 at 12:15
37

This violates PCI-DSS

They are only allowed to use security code or fullstripe data momentarily during a transaction. They are not allowed to retain it, even for a minute.

Even worse, this form has the fivefecta of the 3 credit card fields, cardholder name and Billing ZIP. That's all you need to plug into most website order forms.

This document appears to be a carrier document for a bunch of things, and is then filed or forwarded on as a proof of payment or somesuch. It sits in their mailbox, sits in some clerk's inbox, gets stacked and piled, gets passed around the university departments, and you know they file it. Retaining this is the height of moronitude, and someone needs to explain it to them.

All it takes is for someone who knows their mechanism to grab a stack and run, then later sit somewhere on campus on their WiFi ordering Macbook Pros. For double laughs, from the Apple student webstore for that university, so it's hard to tell it from a bona-fide student purchase.

Due to the liability shift, the university would be on the hook for the subsequent audit, fines, and every fraudulent charge.

They need to make whatever arrangement they need to make with their bank such that they can run these charges without the security code.

  • 9
    Incorrect. Words of PCI "PCI DSS does not prohibit the collection of card verification codes/values prior to authorization of a specific purchase or transaction. However, it is not permitted to retain card verification codes/values once the specific purchase or transaction for which it was collected has been authorized." They can collect the information on paper, as long as it is shredded after they obtain authorization. – user71659 Dec 21 '18 at 19:51
  • @user71659 on second read of that, I see where that makes sense, but I find it difficult to believe the text imagines extended retention of that data, on paper, sent through mail, intercampus mail, handled in offices etc. for days. Maybe if it was handled in the same manner that they handle cash payments, but I really do not think that is the case. – Harper - Reinstate Monica Dec 21 '18 at 20:33
  • Did OP ever indicate the intention is to print this form and fill it out on paper? We all seem to have assumed that. They could well expect it to be filled electronically and e-mailed to them; in which case it is basically impossible to actually destroy the information after use in a PCI compliant way. While it's possible this could be part of a technically compliant with regulation if not intent process (the form is printed and shredded properly immediately after use), the process would be burdensome and unlikely to actually be followed. – Affe Dec 21 '18 at 23:56
  • @user71659: Another strike against your idea that it can be stored for an arbitrary length of time until the transaction is processed: Cards that have dynamic CVV codes – Ben Voigt Sep 19 at 22:10
  • @BenVoigt By golly, I think you might be right. – Harper - Reinstate Monica Sep 19 at 22:15
26

The reason that they are asking for it is because they need it in order to process the credit card payment. They are required by their credit card processor to enter it. If you do not provide it, they will not be able to charge your credit card.

If you want to pay for this service with your credit card, then yes, you should provide them with this code.

An unscrupulous worker at the school could use the information on this form to make fraudulent charges on your card, but that can happen at any time for a whole host of reasons that are out of your control. You need to scrutinize your credit card transactions continuously to look for bad charges and contact the credit card company if they are discovered.

When you find fraudulent transactions, they may be a result of someone from the school, but they could instead be a result of a hacking or skimming event that has nothing to do with this school. You will not be held liable for those charges.

  • 13
    Good answer, altough I wonder why this school is still using paper to process credit card payment. Online payments on secure page are safer than on paper. Where I live, you can pay college charges directly on the college's website (talking about cc payment). – Gainz Dec 20 '18 at 12:47
  • 13
    "If you do not provide it, they will not be able to charge your credit card." is flatly wrong. They may be unable to process it as a "Card Present" transaction, which may cause higher fees from their processor, but the only mandatory information is card number and expiration date -- even zip code mismatch is a warning not a fatal error. And the more information you provide, the stronger the bank's case that you authorized the use of your card (as opposed to initiating a single transaction). OP will be liable for transactions made by someone he authorized to use his card. – Ben Voigt Dec 20 '18 at 17:36
  • 5
    @BenVoigt I disagree, and I believe you are mistaken. The security code is not a secret PIN, it is not proof that you authorized a charge, and it will not make you liable for a fraudulent charge. – Ben Miller - Reinstate Monica Dec 20 '18 at 17:45
  • 22
    @BenVoigt is correct, this answer is totally wrong and should be removed. Card verification numbers are not supposed to be stored. They are not secret (i.e. the customer can give them to a vendor), but recording them in non-volatile media (i.e. paper, database, etc.) would make this vendor non-PCI-compliant. The only reason they would need them would be to miscategorize their transaction. "Card-on-file" and "recurring" transactions don't require them. – SaSSafraS1232 Dec 20 '18 at 21:30
  • 10
    @SaSSafraS1232 No, you're totally wrong about CVVs. CVVs may not be stored after authorization. Visa's exact words "Never retain full-track, magnetic-stripe, CVV2*, and chip data subsequent to transaction authorization." As long as they shred the form after authorization, they are in compliance. There is no requirement about "non-volatile media". And note their asterisk: "In certain markets, CVV2 is required to be present for all card-absent transactions." – user71659 Dec 21 '18 at 3:48
7

This is completely insecure and personally, I wouldn't supply the info.

As you've reasoned, you will have no idea how your information is used once it's left your hands, and you'll never know if it's been disposed of properly (shredded/destroyed). Furthermore, the fact that they follow such insecure practices tells you that at the institution level they haven't a clue about the importance of protecting private and financial information. That means everyone from the janitor to the school president are going to be putting your information at risk.

If you must do this, some options:

  • see if you can pay in person.
  • create a temporary credit card number with a very low limit (some cc's offer this feature)
  • pay by cash.
  • 1
    Do they really need your personal bank account number? ACH fraud is really dangerous. – trognanders Dec 21 '18 at 20:56
  • 1
    @trognanders, good info, removed the check comment! – James Dec 22 '18 at 16:10
6

Placing all of the information required to authorize a card not present transaction on a paper form that will be subject to potential mail theft of skimming in the office is not a particularly good idea. Other answers mention things the school should do. This is not a helpful way to think about the problem... you are not the school and have no agency over their practices. Instead, protect yourself.

Consider alternative payment options:

  1. Money order/cashiers check. Do not give them a personal check, the numbers on the bottom are much more dangerous than the CVV2 code on a credit card
  2. Cash (get a receipt though!)
  3. Prepaid Visa card.

They may be less keen on accepting checks or cash because it is not the process, but a prepaid Visa limits your risk to the stored value and you can throw it in the bin afterwards.

  • 2
    +1 for solving the real issue, since just saying "hey, your policy is bad, and you need to change it" is unlikely to have any effect, particularly since the people that the prospective student is likely to be able to speak to are unlikely to be people who have the authority to make a change. – Beska Dec 22 '18 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.