14

When I obtain a new credit card, I take care to remember the three-digit CVV number stamped into the back of the card, and then remove the number from the card (very thoroughly, because it's usually stamped very hard into the card).

This is so that you cannot take my card for two minutes and use the printed numbers to do your online shopping. I have, on occasion, had to explain to merchants that they do not need my cvv number when doing (in-person) purchases (these places are usually of less than stellar repute, such as car rental on a Greek island).

I have never had to walk away from a desired purchase because of this practice.

But why, then, is it on the card to begin with, and not provided in a separate "important" envelope in the same way as the PIN? Why is this not a glaring security risk?

5
  • 3
    Just speculation, but most people would not remember the number easily, especially because it changes with a new card and mist people have several cards.
    – Karen
    Jun 14, 2016 at 10:57
  • 1
    Interesting question. This should be no harder to learn than an ATM pin...
    – keshlam
    Jun 14, 2016 at 12:39
  • 5
    @Karen, by that logic the PIN should also be on the card ...
    – KlaymenDK
    Jun 14, 2016 at 13:06
  • 2
    If would be interesting to know what the bank would say in response to this question. Ask them?
    – keshlam
    Jun 16, 2016 at 14:21
  • Note the physical Apple Card (not saying this a unique case, I have no idea) doesn't have a CVV on it to start with.
    – chepner
    Aug 28, 2019 at 14:38

3 Answers 3

14

If you would like to scrape the security code off the back of the card, there is nothing stopping you. However, it may hurt the usability of the card, and you won't be gaining as much security as you might think.

The purpose of the security code has been discussed in another question, but basically, it is there to prove that you have the physical card in your hand in cases where it is uncertain that you do. When you are at a physical store and scan your card at a Point of Service (POS) terminal, either by magnetic strip or by chip, you don't need the security code. However, if the scan fails and the clerk needs to type in your number, the POS terminal will generally ask for the security code to prove that the physical card is present. If the clerk can't read the security code, you'll need to provide it. If you are in a situation where you aren't there with the clerk at the terminal (a restaurant setting, for example), this will result in a delay.

Removing the security code does provide a security benefit, but only in two specific circumstances that I can think of:

  1. If your card is physically stolen.
  2. If a store clerk writes down your card number while temporarily in possession of your card.

In the first instance, once your card is physically stolen, you will report it, and you will be on the lookout for fraudulent transactions. The fact that the security code is not present on the card is only of minimal benefit, because the thief can still use the card at a physical store, until the card is deactivated. You will not ultimately be held responsible for any fraudulent transactions.

In the second instance, this security measure could be of use, but again, you won't ultimately be held responsible for any fraudulent transactions.

Neither of these types of fraud are the most common. Instead, much more common is cases where your card number is obtained either by skimming or by hacking. Scraping off the security code will not stop either of these.

6
  • If you're buying something on internet using your credit card, you need provide cvv code, than bank will send you generated authentication code to your phone number, you need to enter to proceed what you buy.
    – Yohanim
    Aug 27, 2018 at 9:35
  • 5
    @YohanesAI, not on my internet...
    – quid
    Dec 18, 2018 at 23:56
  • @quid what country u live?
    – Yohanim
    Dec 19, 2018 at 7:30
  • 1
    @YohanesAI 3DSecure is optional on several countries (most famously the US), merchant can opt to them so they'll be charged less in case of fraud. On the other side, banks themselves can force that all transaction on the card use 3DSecure, so if the payment gateway don't support 3DSecure, the transaction will fail.
    – Martheen
    Dec 21, 2018 at 10:44
  • In Europe it's not common to give away credit card to clerks or other strangers therefore hiding CVV is less necessary. Nowadays the important thing is the chip and the PIN. There are even cards without physical number and magnetic strip nowadays.
    – Sulthan
    Dec 23, 2018 at 20:41
3

I spent a couple of days in the UK a few years ago and the only two places at which I used my credit card were admissions to major tourist attractions (London Zoo and Madame Tussauds). One of those cashiers must have looked at the security code on the back of my card because a couple of days later I got a call from my credit card company saying that someone had stolen my number (including the security code) and was using it to pay bills online. They said it happened a lot.

I wasn't liable for any of these fraudulent charges, of course, and the credit card company was great to deal with but still, I had my card frozen while I was traveling outside my home country AND had the very nasty and lingering feeling which comes of knowing that one of the two smiling young men who welcomed me and my children to either the wax museum or the zoo was at that same moment stealing from me.

As a previous poster commented, I suppose this sort of theft will die out as chip-readers take over but in some countries (including Lebanon where I currently reside) it is still normal practice for a cashier to take your credit card from your hand, turn around and swipe it through the reader beside the cash register. (Interestingly, I have never had my credit card number stolen here in Lebanon even though I have been handing my card – security code visible – to store employees every day for years.)

I'll be visiting London again next week and am planning to either scrape the number off of the back of my card or put a bit of sticky label over it. Just in case.

2
  • Why not use a visa electron - which can't be used for online purchases? Or get an extra card, which can act as a 'burner' which you cancel immediately when you get home?
    – Atheist
    Aug 28, 2019 at 6:33
  • "but still, I had my card frozen while I was traveling outside my home country" This is why you bring a second card in your luggage.
    – RonJohn
    Aug 28, 2019 at 14:06
0

One of my credit cards explicitly states is the property of the issuing bank on the back; all of my credit cards include the legend "use of this card is subject to the cardmember agreement".

Does the contract you agreed to discuss your proposed action?

Operationally, its unlikely the issuer would find out if you did this, nor would they care, but if you choose to deface the property and interfere with a security feature selected by the issuer, be clear with yourself that you may be using the card outside of the agreed terms.

2
  • I'm pretty sure it's "my" card, and not as you describe the bank's card. Frankly, to be sure, I'd have to re-read the agreement more carefully that I can be bothered to.
    – KlaymenDK
    Jun 16, 2016 at 13:00
  • 1
    @KlaymenDK I read the terms and conditions of my credit card (CapitalOne, USA) before I wrote my answer, and I couldn't find anything there that suggested it would be wrong to do this. It does say that the card is their property, but that wouldn't stop me from scraping the numbers off, if I choose to (which I don't).
    – Ben Miller
    Jun 16, 2016 at 14:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .