Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a follow-up question relating to this question:

How does Amazon bill me wihout the CVC / CVV / CVV2?

If amazon.com can bill without the CVV why does it ask for it the first time information is entered? Maybe they just silently discard it? Maybe the first transaction you ever do utilizes your CVV but subsequent ones don't?

I was looking at the specs for a particular payment gateway and one thought I had based on that was that maybe amazon.com could be doing a pre-auth for $0.00, with the CVV / CC#, getting a transaction ID for that and then passing the transaction ID to the payment gateway on all subsequent calls, charging a different amount each time?

share|improve this question
add comment

2 Answers

Anybody can charge cards without CVV - it may require some negotiation or arrangements with your merchant account people, but it can be done. It can also be done without a valid expiration date. If you have a good track record (no or low chargebacks) it's rather easy to do.

If you run a charge without CVV or exp date, (or without AVS info) you are processing a 'riskier' transaction and will pay a higher processing rate for that transaction.

share|improve this answer
add comment

TylerL already answered this on the related question; when you add a new credit card to your account, they ask for the code once to confirm that the card is physically present in the moment of adding.

This gives them a little more confidence that the card is legit, but still lets them offer one-click purchasing, etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.