31

Two nights ago I made a purchase from a website, and it didn’t ask for my CVV. Now, I woke up to an email asking for it. It hasn’t gone through my account yet. Is this as shady as I’m making it out to be?

Here is the text of the e-mail message I received:

Dear Katelyn,

We are ready to process your order but we need the additional three digits located on the back of your credit card on the strip where you sign your name. Please supply us with this number so that we can expedite your order.

| improve this question | |
  • 1
    Welcome new user - tell us in general what type of thing is sold on the web site? Just generally speaking. – Fattie Jul 14 at 11:38
  • 34
    @Fattie Why? Would that significantly affect recommendations in handling this email? Genuinely curious. And new user is named Kat. – maxathousand Jul 14 at 13:50
  • 8
    @maxathousand - my thinking was, many product categories are much, much, much more scammy than others. – Fattie Jul 14 at 13:59
  • Could you contact the company by other means to confirm that the email is from them? – Quora Feans Jul 15 at 5:34
  • @maxathousand Why not? Can you give one good reason not to? Generally when asking for help, it's good to provide as much information as is reasonable and relevant. The asker posted the question on the public internet. We are not invading their home asking what they're spending money on. We have reason to ask. – user91988 Jul 15 at 20:20
87

DO NOT respond directly to the email with your information.

I cannot stress that enough: DO NOT respond to the email with any valuable information. If you decide to send them the CVV number to process the order, go to their website (do not click on a link in the email), and reach out to them using a customer service email or "Contact Us" number and ask them directly if they have requested this information. If they did, call them over the phone and share the CVV that way, rather than in an email.

This sounds like it could be phishing, where a scammer pretends to be someone you've done business with, and asks you for information that can be valuable. Usually it's for a bank user name and password ("Your password has been compromised. Click here to reset!" -- Never ever click there). If we're honest, I don't think this is phishing (a scammer would need your CC details for the CVV to be of any use), but it could be and it's important to develop safe habits.

A merchant uses that code to process the payment and verify possession of the card if they aren't handed the card in person (i.e. internet purchases). So if they didn't ask for it before, that was probably a mistake and at the very least opens them up to more liability. If they're new to accepting credit card payments, it's possible that they're still figuring everything out and it's an honest mistake. But that's the sort of thing they really should figure out after running a couple of orders (of course, a scammer would have that figured out too, so I wouldn't consider that a red flag per se). (NB: Apparently, the requirement isn't as strong as I originally thought (see comments), but I would consider needing the CVV the norm)

I might be willing to give them a benefit of the doubt if it's a new and small operation (and more businesses have become internet based the last few months for obvious reasons), but I'd be extremely wary of responding directly to the email with any personal or remotely valuable information for the reasons stated above. Reach out to the company directly through the website to confirm, preferably with a phone call. It's not perfect, but much more secure with hopefully just a little more effort.

| improve this answer | |
  • 28
    CVV is actually not required for internet purchases, even though, in practice, every legitimate place does use it. Maybe you got confused because you cannot store a CVV number? But transactions can go through without CVV or even with the wrong CVV. Source: I use Stripe and you can disable the rule that blocks payments without or with the wrong CVV. No idea what use case would be but it can be done. – Bakuriu Jul 14 at 5:51
  • 34
    @Bakuriu The most notable example I'm aware of is that Amazon does not ask for the CVV. It pushes more of the cost to them in the event of fraud, but they consider it worthwhile to reduce the friction of checking out and increase customer conversion.. – Chris Hayes Jul 14 at 6:19
  • 3
    @ChrisHayes Surely the friction of the CVV is insignificant compared to the friction of all the other data? – user253751 Jul 14 at 11:12
  • 17
    @user253751 Amazon can tokenise most of the card data for the purpose of a repeat transaction, but keeping CVV is strictly forbidden. If they're prepared to take the additional liability, they can opt to re-use the saved card token and submit it without the CVV, meaning they don't have to ask the user to input any card information at all, so it becomes effectively frictionless. – David Fulton Jul 14 at 13:18
  • 14
    @user253751 The effort of getting the CVV can be immense, comparitively. Safari (and maybe other browsers) will happily store and auto-complete (if I want) my name, shipping address, card numbers, and expiration dates. I can completely fill an order form with a couple auto-complete prompts. Providing the CVV requires getting up and locating the actual card, since my wallet is basically never in my pocket when I'm sitting at a computer. – nobody Jul 14 at 13:19
32

It may not indicate fraud but it suggests incompetence/amateurism on the part of the business. This is not the normal flow for accepting credit card payments -- have they just started doing so?

Ben Miller says:

They could just as easily have been mishandling the code if they had asked for it at checkout.

But asking for it at checkout is likely part of a standard software process. Asking for it in an email suggests an unusual, manual, "roll-your-own" process that is likely less secure than a standard one. Even if you won't be liable for any fraud, it's a sign that the business may also be amateurish in other ways (quality, customer service).

| improve this answer | |
  • With all the big name stores that were hacked and card numbers stolen in recent years, I don’t know that we can generalize that fancier websites and standard processes are any more secure than a mom-and-pop doing things manually. In any case, that’s what $0 fraud liability is for. – Ben Miller - Remember Monica Jul 13 at 18:40
  • 1
    Most small online merchants are not authorized to process sensitive card data at all - in their normal payment authorisation flow they would redirect to some merchant gateway which would get the card number and CVV without the merchant being able to see the data. I also believe that PCI DSS does not allow a manual authorization process that involves sensitive data being transmitted and stored insecurely (i.e. over email) - phone authorisations work, but this does not seem something like a legitimate merchant would be allowed to do by their merchant bank/gateway agreement. – Peteris Jul 14 at 8:50
  • 11
    Yup, just checked - PCI DSS explicitly prohibits an "unusual, manual, "roll-your-own" process" that involves exchanging card data over email. In the standard, "4.2 Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, SMS, chat, etc.)". For "Sensitive authorisation data" such as CVV, it's even stricter than card numbers - you can't store them at all after authorisation, accepting CVV over email would need to ensure (and verify in audit) that the number is scrubbed from any and all email servers, logs and backups, which is nearly impossible. – Peteris Jul 14 at 9:00
20

Even if this is an innocent request it's wrong.

PCI-DSS regulations (which have a global reach) are extremely strict about the management of card data. Certain values cannot be retained at all and some must be encrypted both in transit and at rest. The CVV is one of the more protected fields, so the fact that they're asking you to send it by e-mail is already a breach.

At the very least, they don't know what they're doing. This could be captured by a secure web form (most small companies just get an acquiring service to host the page for them), but e-mail capture is definitely not on.

| improve this answer | |
  • 17
    Agree. Never put anything in an email that you wouldn't write on a postcard. – Maaark Jul 14 at 12:47
  • @Maaark - nice analogy. – David Fulton Jul 14 at 13:09
  • I would think a legitimate but improper request to send confidential information over email should be met with an offer to telephone the company with the proper information if they email back information about how to reach the proper person through the company's main number. Though I knew someone who took that route and then got co-copied on an email where the person he phoned sent the confidential information to the person at the company processing the payment. Grrrr.... – supercat Jul 14 at 15:14
  • @Maaark: while a good analogy, I'm not sure it's effective enough in this case. For you or I it goes without saying not to write your CVV on a postcard, but I'm pretty sure there are a lot of people out there who could be persuaded to send their CVV on a postcard, to a company that already had their card number and other details, reasoning that someone seeing the CVV alone isn't dangerous. "Don't give out your CVV except when placing an order by telephone or via a secure web form" is more like it! – Steve Jessop Jul 15 at 17:22
  • @Maaark: to be more precise, 6 of those people are Ben Miller and the 5 upvoters of that answer at time of writing! – Steve Jessop Jul 15 at 17:29
7

In my opinion, this really depends on the website. If the website is not really a storefront, but is - for example - a local (local to somewhere, anyway) gaming store that sells Magic/Pokémon cards online, something like that, where they take your information through the website but actually enter it in to their POS system by hand, then this is an entirely reasonable thing. This isn't a great way to do things - no part of a system where they enter information into POS that they collected another way is, and it's almost certainly not compliant with how they ought to be doing things - but it's not surprising, either, and probably not fraudulent in that case; they simply forgot to require the code during the checkout process.

However, if the website seemed to be complete with payment information built in, then I would be more wary. That makes it sound a lot more like phishing, to me.

All things considered, though, this seems somewhat low likelihood to be phishing, and high likelihood to be a store that's ... not highly secure. I would not email them back, but instead call them. If they're like I describe and doing things manually in their POS system - then it's possible you can handle this over the phone. Avoiding the CVV code being in email is one major benefit, and secondly you confirm that the email really did come from them by contacting them via a different method (and look up their phone # online, don't use the email you were sent.)

| improve this answer | |
  • Who cares if it's phishin? It's shady! – jpaugh Jul 14 at 22:41
  • 1
    You're not allowed to save the CVV code, so the part of your premise where they forgot to require it is invalid/at least as big a problem as the request in email. – Dan Is Fiddling By Firelight Jul 15 at 20:11
  • 1
    @DanIsFiddlingByFirelight My suggestion here is that they're a small operation that doesn't follow these protocols correctly, yes. Just trying to differentiate between "not paying attention to the rules" and "scamming"; I think the former is more likely than the latter. – Joe Jul 15 at 20:59
4

Adding to @davidfulton's answer...

The CVV is a "proof of possession" indicator. If you know the CVV, then it means the card is in your hand and you are reading it off the card. It should never be permanently recorded anywhere. When I'm talking to a customer service agent and they ask for the CVV, my response is "are you writing it down or are you inputting it into a computer?" If it's the former, I don't give it to them.

A properly constructed credit card processing system will handle the CVV properly (and these systems get audited all the time). Writing it down on a piece of paper or putting it in an email is just wrong.

Anyone who knows your CVV and your card number can prove that he/she "possesses" your card.

And yes, PCI-DSS is very fussy about what a merchant can do with card information and CVV information in particular. They should never be asking you to put it in an email.

| improve this answer | |
  • 4
    To clarify: PCI-DSS governs the merchant's procedures, not the customer's. A merchant who routinely asks for the CVV by email runs a serious risk of losing the privilege of accepting credit cards. Banks and credit card processors get all up in the merchant's face if they mishandle this information. – O. Jones Jul 14 at 18:38
  • 1
    @O.Jones: Thanks. I made that clearer. We just finished all the cleanup from our PCI audit – Flydog57 Jul 14 at 19:22
2

As a web developer I know that a store's web site should never store your credit card number. It should be passed to the payment gateway directly and never be stored. If the store still has your credit card number 2 days later to use with the CVV they are mishandling your payment information. Otherwise it is a scam. Don't send your CVV, contact the store to see what is going on (they may have been compromised).

| improve this answer | |
1

CVV is never disclosed unencrypted, i.e. via email. It can only ever be disclosed through a secure credit card processing page. Its probably illegal for the company to request a CVV via email.

| improve this answer | |
  • It's not illegal, but it is a gross violation of the merchant's agreement with his credit card processor - CVV must be strickly handle using PCI-DSS rules (and this is just wrong). – Flydog57 Jul 16 at 23:03
0

Let me ask you these questions:

  • Do you trust this website/business?
  • If they had asked for the CVV code at checkout, would you have provided it?
  • Do you believe that the email message you received is really from the company?

If you can answer yes to all these questions, then go ahead and give them the code. If you do not give them the code, your order will be cancelled and you will not be receiving your item.

I expect someone to comment at this point and suggest that what they are doing is illegal/improper, and that they shouldn’t need the code. I would say to them (and to you) that this company would not be asking for the code if they didn’t need it to process your order. If you would have provided it at checkout if asked, then you should provide it now.

They will also suggest that the company is mishandling the code. They may or may not be, but that is not really a concern of yours. They could just as easily have been mishandling the code if they had asked for it at checkout.

If it turns out that someone at this company is a crook, or if they get hacked and your card number & code get stolen, you will not be liable for the fraudulent charges. So while it is good to be cautious, if you have no reason to suspect the company/website is fake, I would say go ahead and give them the code.

| improve this answer | |
  • 9
    One reason to provide it at checkout but not over e-mail is that e-mail is not secure. In a normal flow, the data should have been sent over an encrypted connection, and should be scrubbed after authorization. This is difficult to guarantee with e-mail as copies may exist on e-mail servers, in recycling bin, etc. I don't believe it's illegal but it's not PCI DSS compliant. That doesn't mean they are crooks, they are probably honest but have slightly dodgy processes. Personally if I trust the business I'd be ok sending just CVV over e-mail, but not CVV + credit card details in the same e-mail. – JB Chouinard Jul 13 at 21:23
  • 3
    @JBChouinard Yes, e-mail is not secure, but the message is not asking for the CVV and credit card number via e-mail, just the CVV, which is a useless three digit number without the credit card number (which they already have). Remember that the CVV is not a PIN, and you hand your card with both pieces of information to strangers all the time. – Ben Miller - Remember Monica Jul 13 at 21:37
  • 6
    Do you believe that the email message you received is really from the company? I've been doing IT professionally for 20 years, and my first job was babysitting mail servers. I wouldn't trust myself to accurately judge whether the message really came from the company and would presume it was phishing. (I'd call the company to either confirm and educate or disconfirm and warn them they had a breach.) – chrylis -cautiouslyoptimistic- Jul 14 at 3:23
  • 2
    @JBChouinard CVV has stricter limitations than card numbers, there are many kinds of processing that are permitted for card numbers but prohibited for CVVs. Quoting PCI DSS, "Sensitive authentication data must not be stored after authorization, even if encrypted. This applies even where there is no PAN in the environment. " (sensitive authentication data includes CVV; PAN is the card number) - so it explicitly includes the scenario of CVV being sent separately. PCI DSS 3.2 requires you to ensure that the email with that number is unrecoverably (!) erased from all systems after authorisation. – Peteris Jul 14 at 9:08
  • 2
    @Peteris Like I said, I'm aware it's not PCI DSS compliant. If it was a payment system I was responsible for, it would bother me quite a bit. As a customer? Meh. With zero liability fraud protection, either the merchant or the bank is liable. Having my CC info stolen is an inconvenience so I'm not gonna give out to possibly malicious actors, but it's not my job to do PCI DSS audits of every merchant I interact with. – JB Chouinard Jul 14 at 15:03
-1

Your credit card details can be seen as public

Your credit card details have been handled in an insecure way, and you should contact your bank to have the card revoked and get a new one.

What have happened

To handle credit card payments over Internet the company need to be PCI-DSS certified (thanks David Fulton for the full certification name). The certification is mandatory by the big credit card companies like Visa and MasterCard. This certification is in place to make sure the credit card details are handled in a secure way.

But a webshop doesn't need this certification if they use a third party payment provider. In that case all credit card information is handled by the payment provider. By sending the credit card information directly to the payment provider the webshop never handle any credit card information at all.

The webshop you have ordered from doesn't have, or doesn't follow, the PCI-DSS certification. This is obvious by them asking for the CVV by email. And they don't use a third party payment provider that have the PCI-DSS certification, by the same evidence. At least not in the intended way. Most likely they are trying to develop at least the UI for the payment without fully knowing what they do.

The result of this is that the credit card details added to this webshop can't be trusted. They have showed that they can't handle the security needed for credit card data. As such I would treat all information for that webshop as public.

Please note that I'm not saying that the webshop have acted knowingly maliciously. But it's about your money, does it really matter if it's knowingly or not?

What to do now

I can't tell you what to do, but this is what I would do:

  1. Contact the bank and stop the payment for this order. I don't want to make business with dodgy companies, I would rather order the product elsewhere for a few bucks extra.
  2. When talking to the bank, cancel the card and order a new one. A new one with a new credit card number. As stated above I consider your credit card details to be public. And since you know it's been used a bit dodgy, you probably won't get the money back if it's used for something you haven't ordered.
  3. Contact the webshop and cancel the order. Do this as soon as possible, after stopping the transaction and cancelling the card.
  4. Contact your credit card company (Visa, MasterCard etc) and report the webshop to them. Hopefully they will investigate the webshop. That way you help making sure no one else gets into this mess.

Could it be something else

As stated in other answers this could be phishing. But if it is, shouldn't the order be completed by now? And how did the phishers know you placed an order in that webshop? If you made it public on the Internet it could be they have picked it up from there, otherwise they got the information from the webshop.

But again, it's your money on the line. I think it's better to be safe than sorry.

| improve this answer | |
  • 1
    This is a gross overreaction. There is no evidence that the merchant intends to place fraudulent charges on the card. You are fooling yourself if you don’t think that there are now many people that work at many companies that can already read your credit card number if they want to. Also, you, as a customer, are not the payment gateway standards police. That is between the merchant and their bank. You will not be liable if fraudulent charges do eventually show up on the card, and if they do, you have no way of even knowing whether the security breach was at this merchant or at Wal-Mart. – Ben Miller - Remember Monica Jul 16 at 13:08
  • However, I do agree with you that this is unlikely to be a phishing attempt. – Ben Miller - Remember Monica Jul 16 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.