Is the 3-digit (4-digit for those acolytes of standardization, American Express!) CVV/CSV/CVC calculated from card number and expiration date, or is it merely assigned? I know that once when I got a renewed Visa, it had the same 16-digit account number, different expiration date, and different CVV2.
I've seen some hints that CVV/CSV/CVC can be calculated, but those were in marketing collateral for a credit-card-processing appliance whose name I can't remember maybe 10 years ago. It would seem that compromising such an algorithm would be a very bad thing indeed, but the whole of the credit card industry is riddled with dumb ideas.