Is it a good idea to scrape away my credit card's cvv code?

Question

When I obtain a new credit card, I take care to remember the three-digit CVV number stamped into the back of the card, and then remove the number from the card (very thoroughly, because it's usually stamped very hard into the card).

This is so that you cannot take my card for two minutes and use the printed numbers to do your online shopping. I have, on occasion, had to explain to merchants that they do not need my cvv number when doing (in-person) purchases (these places are usually of less than stellar repute, such as car rental on a Greek island).

I have never had to walk away from a desired purchase because of this practice.

But why, then, is it on the card to begin with, and not provided in a separate "important" envelope in the same way as the PIN? Why is this not a glaring security risk?

Answer 1

If you would like to scrape the security code off the back of the card, there is nothing stopping you. However, it may hurt the usability of the card, and you won't be gaining as much security as you might think.

The purpose of the security code has been discussed in another question, but basically, it is there to prove that you have the physical card in your hand in cases where it is uncertain that you do. When you are at a physical store and scan your card at a Point of Service (POS) terminal, either by magnetic strip or by chip, you don't need the security code. However, if the scan fails and the clerk needs to type in your number, the POS terminal will generally ask for the security code to prove that the physical card is present. If the clerk can't read the security code, you'll need to provide it. If you are in a situation where you aren't there with the clerk at the terminal (a restaurant setting, for example), this will result in a delay.

Removing the security code does provide a security benefit, but only in two specific circumstances that I can think of:

1. If your card is physically stolen.
2. If a store clerk writes down your card number while temporarily in possession of your card.

In the first instance, once your card is physically stolen, you will report it, and you will be on the lookout for fraudulent transactions. The fact that the security code is not present on the card is only of minimal benefit, because the thief can still use the card at a physical store, until the card is deactivated. You will not ultimately be held responsible for any fraudulent transactions.

In the second instance, this security measure could be of use, but again, you won't ultimately be held responsible for any fraudulent transactions.

Neither of these types of fraud are the most common. Instead, much more common is cases where your card number is obtained either by skimming or by hacking. Scraping off the security code will not stop either of these.

Answer 2

I spent a couple of days in the UK a few years ago and the only two places at which I used my credit card were admissions to major tourist attractions (London Zoo and Madame Tussauds). One of those cashiers must have looked at the security code on the back of my card because a couple of days later I got a call from my credit card company saying that someone had stolen my number (including the security code) and was using it to pay bills online. They said it happened a lot.

I wasn't liable for any of these fraudulent charges, of course, and the credit card company was great to deal with but still, I had my card frozen while I was traveling outside my home country AND had the very nasty and lingering feeling which comes of knowing that one of the two smiling young men who welcomed me and my children to either the wax museum or the zoo was at that same moment stealing from me.

As a previous poster commented, I suppose this sort of theft will die out as chip-readers take over but in some countries (including Lebanon where I currently reside) it is still normal practice for a cashier to take your credit card from your hand, turn around and swipe it through the reader beside the cash register. (Interestingly, I have never had my credit card number stolen here in Lebanon even though I have been handing my card – security code visible – to store employees every day for years.)

I'll be visiting London again next week and am planning to either scrape the number off of the back of my card or put a bit of sticky label over it. Just in case.

Answer 3

One of my credit cards explicitly states is the property of the issuing bank on the back; all of my credit cards include the legend "use of this card is subject to the cardmember agreement".

Does the contract you agreed to discuss your proposed action?

Operationally, its unlikely the issuer would find out if you did this, nor would they care, but if you choose to deface the property and interfere with a security feature selected by the issuer, be clear with yourself that you may be using the card outside of the agreed terms.