The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I know I never entered the CVC on Amazon when I added my card to it, and this has been bugging me ever since. How do they successfully charge the card without the CVC code?
That code isn't necessary. This may cause more fraud and more chargebacks, but Amazon keeps those numbers low so that they can offer a faster shopping experience such as one-click.
The only thing necessary to make a purchase is the card number, whether in number form or magnetic. You don't even need the expiration date. Most systems require more information (such as matching full name, bank phone number, physical billing address with zip code, et al) so that they can deal with fraud and/or chargebacks, and sometimes this is enforced by the issuing bank.
The CVC (sometimes "CVV" or "CVV2") is supposed to indicate whether the card is present at the time of the transaction. Card companies require that it never be stored or recorded, but rather passed directly from the customer to the merchant gateway and then immediately forgotten. Therefore, any time you give that number to a merchant, they're supposed to use it immediately and then immediately forget it.
Since this number is theoretically never recorded in any database, having this number present at the time of the transaction should indicate with greater certainty that the card itself is truly present and therefore that the transaction is not fraudulent. As such, providing this number decreases the probability of the transaction being rejected.
Alternately, a transaction submitted without the CVC indicates that the transaction was submitted using previously stored credit card information, but the card was not itself present at the time of the transaction.
Some merchants ask you to provide this number when saving a card on file. What they should be doing with the verification code if they do so is requesting verification from the bank that the code does in fact match, but then they should not store the CVC code in their database. The purpose would be to ensure that you're not storing on file a stolen credit card--primarily for the merchant's safety.
If a merchant does in fact store this code and a card company finds out, it's big trouble and can result in some steep fines.
Amazon pays a slightly higher rate to accept your payment without the CVV, but the CVV is not strictly required to present a transaction - everybody uses CVV because they get a lower rate if it is present (less risk, less cost). Nobody who knows what they are doing will store your CVV - if the card networks suspect that you are storing CVV, you will have forensic auditors on your site REALLY fast.
Where is the procedure defined? As noted above, it's the bank that boards the merchant account and there is a wide range of flexibility depending mostly on the merchant's track record for many good transactions and very few chargebacks. You and I might not be able to process transactions without an exp date, but Amazon surely can if they want to...
I confirm that Amazon strangely doesn't make use of CVC (also "CVV" or "CVV2"), however there's nothing magical about Amazon itself, it's all up to the bank to accept payments without this security code.
For instance in my case I wasn't able to associate a master card as a payment method because my bank probably didn't accept charging without this code. I asked for assistance at Amazon and was replied:
As you see they suggest asking my bank to temporarily lift this requirement so that they can charge without using the CVC.
So again, some banks may accept not using this CVC, some may not, most probably will whitelist Amazon only because it's Amazon.
This question has been sufficiently answered.
However, one more fact I believe to be interesting and relevant is that even if a merchant collects your CVV2 and discovers that it is incorrect, the merhcnat may still charge you at their discretion.
Reference 23 in the paper cited above is:
This also answers a closely related question (that of charging with an incorrect CVV2, as opposed to no CVV2 at all) that I believe was marked as a duplicate of this question incorrectly.
protected by Lucas 'Paul' Kauffman Sep 2 '13 at 13:23
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?