0

According to Google:

A CVV is the three- or four-digit number on your card that adds an extra layer of security when making purchases online or over the phone. It serves to verify that you have a physical copy of the card in your possession and helps protect you if your card number falls into the hands of hackers and identity thieves.Dec 18, 2019

I fail to see how that is secure at all. Every single time I share my CC # with a processing agent, they also ask for the CVV. Therefore anyone who has heard me read out my number has also heard me read out my CVV. The two go together. All the time. They are never separated. Therefore the statement "it serves to verify that you have a physical copy" is not at all true.

Why hasn't this false "security" feature been obsoleted and replaced with more modern security features. I'd like to see it retired.

Improve this question
2

2 Answers 2

Reset to default
9

There are two reasons why it’s more secure. The first is that when you use your card in person the merchant never gets your CVV, and so if their data is compromised your card number can’t be used for online transactions since your CVV isn’t attached to it. And the second is that PCI rules prohibit merchants from storing your CVV, so even if an online retailer suffers a database compromise your CVV should still be safe since they only had it for long enough to verify a transaction and didn’t store it.

In summary you should be worrying about database leaks, not about someone overhearing you and memorising the nineteen digits you are reading out, and a CVV is a reasonably effective and minimally inconvenient way of protecting you from those.

Improve this answer
10
  • 1
    Reason 3: it's on the back of the card so if someone happens to get a picture of the front of your card they don't know it.
    – user253751
    May 12, 2022 at 8:33
  • @user253751 that's not necessarily so, Amex has it on the front of the card.
    – littleadv
    May 12, 2022 at 16:33
  • 1
    @littleadv: and conversely a few years ago (probably after 2019, but I can't easily check) several of my (nonAmex) cards started putting everything -- name, PAN, expiry, CVX2 -- on the back. Go figure.
    – dave_thompson_085
    May 13, 2022 at 9:08
  • @user253751, if they can get a photo of the front of the card, they can get a photo of the back.
    – Octopus
    May 13, 2022 at 16:31
  • Database leak, overhearing, or just harvesting your info. What's the diff? Equally unsecure in all cases!
    – Octopus
    May 13, 2022 at 16:32
7

They are never separated. Therefore the statement "it serves to verify that you have a physical copy" is not at all true.

They are. The CVV is never stored by the merchants. So while someone can get your card number from statements you threw in the trash or from a data dump leaked from your grocery store, the CVV is only stored on your actual physical card. It also changes every time your card is reissued. Some issuers generate a new CVV every time the card is printed (even if nothing else changes), others only generate a new CVV if something changed (expiration, mostly).

Why hasn't this false "security" feature been obsoleted and replaced with more modern security features. I'd like to see it retired.

It is not at all false. It's a simple and effective method to confirm that you do in fact possess the card you're trying to use. While the magnetic stripe version has been deprecated in favor of the EMV chips, the printed version persists because it's both inexpensive and very effective.

However, it's effectiveness depends on merchants both requiring it and not storing it. While not storing it is a contractual obligation (merchants caught storing CVV2 may end up being dumped by their processors and sued by their consumers), using it to begin with apparently is not. Some online merchants process transactions without ever asking for CVV2 from the customers.

Improve this answer
5
  • It's been a long time since I've seen a merchant not ask for the CVV2 on an initial transaction, many do not with a subsequent transaction with the same card. I have assumed they figured your bona-fides were established the first time.
    – Loren Pechtel
    May 12, 2022 at 3:39
  • 3
    @LorenPechtel Merchants are not required to ask for CVV2, but they risk adverse decisions in case of chargebacks. So it's a risk/benefit decision, I guess.
    – littleadv
    May 12, 2022 at 3:44
  • 4
    It’s still effective if merchants don’t use it, because a merchant who doesn’t use it will end up eating the cost for a fraudulent transaction rather than the card company or the customer. So as far as you and the card company are concerned, it’s done its job.
    – Mike Scott
    May 12, 2022 at 4:13
  • As a web developer myself, I can tell you that whoever is asking for the information can store it however they like, legal or not. There is no guarantee that they aren't storing them both. Just because its on the back means nothing. If someone has access to your card, they have both sides. If you tell the numbers to an agent, they have all of them.
    – Octopus
    May 13, 2022 at 16:29
  • 2
    @Octopus of course you can. You can also steal my wallet and break into my apartment. It doesn't mean that you will. The contracts obligate the merchants to certain things and failure to do them opens the merchants to liability. It doesn't mean merchants don't do shady things, but it does mean that you as a consumer have a recourse.
    – littleadv
    May 13, 2022 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .