Two nights ago I made a purchase from a website, and it didn’t ask for my CVV. Now, I woke up to an email asking for it. It hasn’t gone through my account yet. Is this as shady as I’m making it out to be?

Here is the text of the e-mail message I received:

Dear Katelyn,

We are ready to process your order but we need the additional three digits located on the back of your credit card on the strip where you sign your name. Please supply us with this number so that we can expedite your order.

  • 1
    Welcome new user - tell us in general what type of thing is sold on the web site? Just generally speaking.
    – Fattie
    Commented Jul 14, 2020 at 11:38
  • 34
    @Fattie Why? Would that significantly affect recommendations in handling this email? Genuinely curious. And new user is named Kat. Commented Jul 14, 2020 at 13:50
  • 8
    @maxathousand - my thinking was, many product categories are much, much, much more scammy than others.
    – Fattie
    Commented Jul 14, 2020 at 13:59
  • Could you contact the company by other means to confirm that the email is from them? Commented Jul 15, 2020 at 5:34
  • @maxathousand Why not? Can you give one good reason not to? Generally when asking for help, it's good to provide as much information as is reasonable and relevant. The asker posted the question on the public internet. We are not invading their home asking what they're spending money on. We have reason to ask.
    – user91988
    Commented Jul 15, 2020 at 20:20

8 Answers 8


DO NOT respond directly to the email with your information.

I cannot stress that enough: DO NOT respond to the email with any valuable information. If you decide to send them the CVV number to process the order, go to their website (do not click on a link in the email), and reach out to them using a customer service email or "Contact Us" number and ask them directly if they have requested this information. If they did, call them over the phone and share the CVV that way, rather than in an email.

This sounds like it could be phishing, where a scammer pretends to be someone you've done business with, and asks you for information that can be valuable. Usually it's for a bank user name and password ("Your password has been compromised. Click here to reset!" -- Never ever click there). If we're honest, I don't think this is phishing (a scammer would need your CC details for the CVV to be of any use), but it could be and it's important to develop safe habits.

A merchant uses that code to process the payment and verify possession of the card if they aren't handed the card in person (i.e. internet purchases). So if they didn't ask for it before, that was probably a mistake and at the very least opens them up to more liability. If they're new to accepting credit card payments, it's possible that they're still figuring everything out and it's an honest mistake. But that's the sort of thing they really should figure out after running a couple of orders (of course, a scammer would have that figured out too, so I wouldn't consider that a red flag per se). (NB: Apparently, the requirement isn't as strong as I originally thought (see comments), but I would consider needing the CVV the norm)

I might be willing to give them a benefit of the doubt if it's a new and small operation (and more businesses have become internet based the last few months for obvious reasons), but I'd be extremely wary of responding directly to the email with any personal or remotely valuable information for the reasons stated above. Reach out to the company directly through the website to confirm, preferably with a phone call. It's not perfect, but much more secure with hopefully just a little more effort.

  • 28
    CVV is actually not required for internet purchases, even though, in practice, every legitimate place does use it. Maybe you got confused because you cannot store a CVV number? But transactions can go through without CVV or even with the wrong CVV. Source: I use Stripe and you can disable the rule that blocks payments without or with the wrong CVV. No idea what use case would be but it can be done.
    – Bakuriu
    Commented Jul 14, 2020 at 5:51
  • 34
    @Bakuriu The most notable example I'm aware of is that Amazon does not ask for the CVV. It pushes more of the cost to them in the event of fraud, but they consider it worthwhile to reduce the friction of checking out and increase customer conversion.. Commented Jul 14, 2020 at 6:19
  • 3
    @ChrisHayes Surely the friction of the CVV is insignificant compared to the friction of all the other data? Commented Jul 14, 2020 at 11:12
  • 17
    @user253751 Amazon can tokenise most of the card data for the purpose of a repeat transaction, but keeping CVV is strictly forbidden. If they're prepared to take the additional liability, they can opt to re-use the saved card token and submit it without the CVV, meaning they don't have to ask the user to input any card information at all, so it becomes effectively frictionless. Commented Jul 14, 2020 at 13:18
  • 14
    @user253751 The effort of getting the CVV can be immense, comparitively. Safari (and maybe other browsers) will happily store and auto-complete (if I want) my name, shipping address, card numbers, and expiration dates. I can completely fill an order form with a couple auto-complete prompts. Providing the CVV requires getting up and locating the actual card, since my wallet is basically never in my pocket when I'm sitting at a computer.
    – nobody
    Commented Jul 14, 2020 at 13:19

It may not indicate fraud but it suggests incompetence/amateurism on the part of the business. This is not the normal flow for accepting credit card payments -- have they just started doing so?

Ben Miller says:

They could just as easily have been mishandling the code if they had asked for it at checkout.

But asking for it at checkout is likely part of a standard software process. Asking for it in an email suggests an unusual, manual, "roll-your-own" process that is likely less secure than a standard one. Even if you won't be liable for any fraud, it's a sign that the business may also be amateurish in other ways (quality, customer service).

  • With all the big name stores that were hacked and card numbers stolen in recent years, I don’t know that we can generalize that fancier websites and standard processes are any more secure than a mom-and-pop doing things manually. In any case, that’s what $0 fraud liability is for.
    – Ben Miller
    Commented Jul 13, 2020 at 18:40
  • 1
    Most small online merchants are not authorized to process sensitive card data at all - in their normal payment authorisation flow they would redirect to some merchant gateway which would get the card number and CVV without the merchant being able to see the data. I also believe that PCI DSS does not allow a manual authorization process that involves sensitive data being transmitted and stored insecurely (i.e. over email) - phone authorisations work, but this does not seem something like a legitimate merchant would be allowed to do by their merchant bank/gateway agreement.
    – Peteris
    Commented Jul 14, 2020 at 8:50
  • 11
    Yup, just checked - PCI DSS explicitly prohibits an "unusual, manual, "roll-your-own" process" that involves exchanging card data over email. In the standard, "4.2 Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, SMS, chat, etc.)". For "Sensitive authorisation data" such as CVV, it's even stricter than card numbers - you can't store them at all after authorisation, accepting CVV over email would need to ensure (and verify in audit) that the number is scrubbed from any and all email servers, logs and backups, which is nearly impossible.
    – Peteris
    Commented Jul 14, 2020 at 9:00

Even if this is an innocent request it's wrong.

PCI-DSS regulations (which have a global reach) are extremely strict about the management of card data. Certain values cannot be retained at all and some must be encrypted both in transit and at rest. The CVV is one of the more protected fields, so the fact that they're asking you to send it by e-mail is already a breach.

At the very least, they don't know what they're doing. This could be captured by a secure web form (most small companies just get an acquiring service to host the page for them), but e-mail capture is definitely not on.

  • 17
    Agree. Never put anything in an email that you wouldn't write on a postcard.
    – Maaark
    Commented Jul 14, 2020 at 12:47
  • @Maaark - nice analogy. Commented Jul 14, 2020 at 13:09
  • I would think a legitimate but improper request to send confidential information over email should be met with an offer to telephone the company with the proper information if they email back information about how to reach the proper person through the company's main number. Though I knew someone who took that route and then got co-copied on an email where the person he phoned sent the confidential information to the person at the company processing the payment. Grrrr....
    – supercat
    Commented Jul 14, 2020 at 15:14
  • @Maaark: while a good analogy, I'm not sure it's effective enough in this case. For you or I it goes without saying not to write your CVV on a postcard, but I'm pretty sure there are a lot of people out there who could be persuaded to send their CVV on a postcard, to a company that already had their card number and other details, reasoning that someone seeing the CVV alone isn't dangerous. "Don't give out your CVV except when placing an order by telephone or via a secure web form" is more like it! Commented Jul 15, 2020 at 17:22
  • @Maaark: to be more precise, 6 of those people are Ben Miller and the 5 upvoters of that answer at time of writing! Commented Jul 15, 2020 at 17:29

In my opinion, this really depends on the website. If the website is not really a storefront, but is - for example - a local (local to somewhere, anyway) gaming store that sells Magic/Pokémon cards online, something like that, where they take your information through the website but actually enter it in to their POS system by hand, then this is an entirely reasonable thing. This isn't a great way to do things - no part of a system where they enter information into POS that they collected another way is, and it's almost certainly not compliant with how they ought to be doing things - but it's not surprising, either, and probably not fraudulent in that case; they simply forgot to require the code during the checkout process.

However, if the website seemed to be complete with payment information built in, then I would be more wary. That makes it sound a lot more like phishing, to me.

All things considered, though, this seems somewhat low likelihood to be phishing, and high likelihood to be a store that's ... not highly secure. I would not email them back, but instead call them. If they're like I describe and doing things manually in their POS system - then it's possible you can handle this over the phone. Avoiding the CVV code being in email is one major benefit, and secondly you confirm that the email really did come from them by contacting them via a different method (and look up their phone # online, don't use the email you were sent.)

  • Who cares if it's phishin? It's shady!
    – jpaugh
    Commented Jul 14, 2020 at 22:41
  • 1
    You're not allowed to save the CVV code, so the part of your premise where they forgot to require it is invalid/at least as big a problem as the request in email. Commented Jul 15, 2020 at 20:11
  • 1
    @DanIsFiddlingByFirelight My suggestion here is that they're a small operation that doesn't follow these protocols correctly, yes. Just trying to differentiate between "not paying attention to the rules" and "scamming"; I think the former is more likely than the latter.
    – Joe
    Commented Jul 15, 2020 at 20:59

Adding to @davidfulton's answer...

The CVV is a "proof of possession" indicator. If you know the CVV, then it means the card is in your hand and you are reading it off the card. It should never be permanently recorded anywhere. When I'm talking to a customer service agent and they ask for the CVV, my response is "are you writing it down or are you inputting it into a computer?" If it's the former, I don't give it to them.

A properly constructed credit card processing system will handle the CVV properly (and these systems get audited all the time). Writing it down on a piece of paper or putting it in an email is just wrong.

Anyone who knows your CVV and your card number can prove that he/she "possesses" your card.

And yes, PCI-DSS is very fussy about what a merchant can do with card information and CVV information in particular. They should never be asking you to put it in an email.

  • 4
    To clarify: PCI-DSS governs the merchant's procedures, not the customer's. A merchant who routinely asks for the CVV by email runs a serious risk of losing the privilege of accepting credit cards. Banks and credit card processors get all up in the merchant's face if they mishandle this information.
    – O. Jones
    Commented Jul 14, 2020 at 18:38
  • 1
    @O.Jones: Thanks. I made that clearer. We just finished all the cleanup from our PCI audit
    – Flydog57
    Commented Jul 14, 2020 at 19:22

As a web developer I know that a store's web site should never store your credit card number. It should be passed to the payment gateway directly and never be stored. If the store still has your credit card number 2 days later to use with the CVV they are mishandling your payment information. Otherwise it is a scam. Don't send your CVV, contact the store to see what is going on (they may have been compromised).


CVV is never disclosed unencrypted, i.e. via email. It can only ever be disclosed through a secure credit card processing page. Its probably illegal for the company to request a CVV via email.

  • It's not illegal, but it is a gross violation of the merchant's agreement with his credit card processor - CVV must be strickly handle using PCI-DSS rules (and this is just wrong).
    – Flydog57
    Commented Jul 16, 2020 at 23:03

Let me ask you these questions:

  • Do you trust this website/business?
  • If they had asked for the CVV code at checkout, would you have provided it?
  • Do you believe that the email message you received is really from the company?

If you can answer yes to all these questions, then go ahead and give them the code. If you do not give them the code, your order will be cancelled and you will not be receiving your item.

I expect someone to comment at this point and suggest that what they are doing is illegal/improper, and that they shouldn’t need the code. I would say to them (and to you) that this company would not be asking for the code if they didn’t need it to process your order. If you would have provided it at checkout if asked, then you should provide it now.

They will also suggest that the company is mishandling the code. They may or may not be, but that is not really a concern of yours. They could just as easily have been mishandling the code if they had asked for it at checkout.

If it turns out that someone at this company is a crook, or if they get hacked and your card number & code get stolen, you will not be liable for the fraudulent charges. So while it is good to be cautious, if you have no reason to suspect the company/website is fake, I would say go ahead and give them the code.

  • 9
    One reason to provide it at checkout but not over e-mail is that e-mail is not secure. In a normal flow, the data should have been sent over an encrypted connection, and should be scrubbed after authorization. This is difficult to guarantee with e-mail as copies may exist on e-mail servers, in recycling bin, etc. I don't believe it's illegal but it's not PCI DSS compliant. That doesn't mean they are crooks, they are probably honest but have slightly dodgy processes. Personally if I trust the business I'd be ok sending just CVV over e-mail, but not CVV + credit card details in the same e-mail.
    – JBGreen
    Commented Jul 13, 2020 at 21:23
  • 3
    @JBChouinard Yes, e-mail is not secure, but the message is not asking for the CVV and credit card number via e-mail, just the CVV, which is a useless three digit number without the credit card number (which they already have). Remember that the CVV is not a PIN, and you hand your card with both pieces of information to strangers all the time.
    – Ben Miller
    Commented Jul 13, 2020 at 21:37
  • 6
    Do you believe that the email message you received is really from the company? I've been doing IT professionally for 20 years, and my first job was babysitting mail servers. I wouldn't trust myself to accurately judge whether the message really came from the company and would presume it was phishing. (I'd call the company to either confirm and educate or disconfirm and warn them they had a breach.) Commented Jul 14, 2020 at 3:23
  • 2
    @JBChouinard CVV has stricter limitations than card numbers, there are many kinds of processing that are permitted for card numbers but prohibited for CVVs. Quoting PCI DSS, "Sensitive authentication data must not be stored after authorization, even if encrypted. This applies even where there is no PAN in the environment. " (sensitive authentication data includes CVV; PAN is the card number) - so it explicitly includes the scenario of CVV being sent separately. PCI DSS 3.2 requires you to ensure that the email with that number is unrecoverably (!) erased from all systems after authorisation.
    – Peteris
    Commented Jul 14, 2020 at 9:08
  • 2
    @Peteris Like I said, I'm aware it's not PCI DSS compliant. If it was a payment system I was responsible for, it would bother me quite a bit. As a customer? Meh. With zero liability fraud protection, either the merchant or the bank is liable. Having my CC info stolen is an inconvenience so I'm not gonna give out to possibly malicious actors, but it's not my job to do PCI DSS audits of every merchant I interact with.
    – JBGreen
    Commented Jul 14, 2020 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .