9

How do those 3 digits on a back of a credit card make it more secure?

  • 1
    How can it not? That's 3 whole extra digits - there's no possible way someone could steal those too! – Jon S Dec 14 '10 at 2:25
  • Those 3 digits are generated when your credit card is being embossed. Other than the machine, nobody other than you knows it. How is that not secure ? – DumbCoder Dec 14 '10 at 11:23
  • No disagreement that no one else knows what those digits are until I share them the first time - so it adds some security to that part of the process. Also nice that good e-commerce citizens try not to store that info. My concern is with the "good" and "try" in that sentence. – Jon S Dec 14 '10 at 16:02
  • 2
    Um, the bank that issued the card must record these numbers otherwise what value do they have? – Sean W. May 5 '11 at 16:18
14

I guess if somebody steals your credit card number from some database or device, such as gas station, they would not be able to use it with some merchants without the code. Merchants are not supposed to store these codes and they are not contained in the magnetic stripe (unlike the number) so asking for the code is a way to ensure you have physical possession of the card. Of course, you could still have stolen it (that's why they also check ZIP code, etc.) but at least it protects to some measure against electronic theft.

See also: http://en.wikipedia.org/wiki/Card_security_code

  • 1
    so they key is "not suppose to store" the 3 digit code? sounds pretty weak security feature. – Vitalik Dec 15 '10 at 5:18
  • 2
    I think Visa actually prohibits storing it and PCI standards too. – StasM Dec 15 '10 at 5:21
  • This is a terrible answer. If the mag strip on your card was a person, that's the only person in the universe the "secret" code is meant to be a "secret" from. – quid Dec 18 '18 at 23:48
6

Online
Online purchasing is the focus of this security measure. You must have (at least, in the US) both the card number and the CSC otherwise you can't make the transaction.

F2F
Not intended as added security for these transactions. Some merchants in the US do ask for it, but f2f is not the target of the measure.

Reasoning
“You don't want someone to have your credit card number and you don't want someone to have the three-digit code, but you really don't want them to have both. It's like losing the car and the keys — someone who has both can buy anything they want. That's why, when thieves are buying stolen credit card numbers they're worth a lot more if they include the three-digit code on the back.” From: http://today.msnbc.msn.com/id/10837640/ns/today-money/

Caveats
If I steal your physical card, I've got the keys to the kingdom until you report it stolen. A little like most computer security measures - they work well until you introduce the human element, and then they start to look a little thin...

Rabbit trails
The code has given rise to a whole new type of scam. See http://www.ksag.org/page/consumer-corner-new-credit-card-scam-seeks-3-digit-code for how criminals who already have the card number now try to get the CVV.

4

The purpose of the code is to prove that you have the physical card in your possession.

Here are the features:

  • For Mastercard/Visa, the code appears on the back of the card, and on American Express, it is on the front of the card, but it is printed and not embossed. This means that if the card is run through the carbon paper "zip-zap" device, the security code will not show up on the carbon paper. (Yes, I am aware that no one uses these anymore.)

  • The code is not in the magnetic strip, so someone with a card cloning device will not get the code.

  • At a point-of-sale terminal, if the card is swiped, the code will not be required for the transaction, but if the card is manually typed in, the code is generally required. This prevents someone with a credit card number from making charges in a store without the physical card.

  • Online retailers are instructed not to store the security code; they are supposed to ask for the security code each time.

No, this does not prevent all fraud; it only prevents specific types of fraud. It is not secure, which is why the chip card was invented.

0

A relevant article claiming to partially answer this question: "Three numbers that can halt credit card fraud:"

‘Today’ financial editor Jean Chatzky explains the importance of protecting your security code, and how thieves are trying to steal it.

The scam described in the article is a phishing scam perpetrated by callers who claim to be alerting you to fraudulent charges on your account and ask for the code to verify you are in possession of the card, and then they can go make whatever fraudulent purchase that lets them make, online or over the phone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.