I built a shop and integrated a card payment system. On the checkout page, we have:
- The card number
- Expiration date
If I use an invalid expiration date, the payment fails, as expected. But if the card number and the expiration date are correct, even if I pass an invalid CVV, the transaction is successful.
Is that expected? If it's not expected, is it a vulnerability of my bank or of the payment service I use?
Update: It does seem it is related to the bank. I tried with a different credit card I have from another bank, and I cannot reproduce the problem. In this case the transaction is created only if the CVV is correct.
Again, should I report this somewhere or it's an expected behavior?