My bank card recently expired. I got a new one and this one turned out to be "lucky": its CVC code was 000.
For a few months I used it extensively, both online and offline, without any difficulties - until the day when I entered my card details on Booking.com. I filled in the form, clicked "submit" - only to see the page discard the value in the CVC field and demand that I enter it again.
I contacted support. They confirmed that CVC code "000" is not acceptable because it is considered not secure enough (not an exact quote unfortunately, as the conversation was in Estonian), and they suggested that I order a new bank card where the CVC code would be different from "000".
That puzzled me. As a former tester, I'm quite used to situations where I think I'm reporting a bug and then I'm told it is actually a feature, but this time it was somewhat against common sense. My current work is also related to information security and I can think of three reasons their claim doesn't make sense:
- CVC is not just a random number, there is a certain algorithm of generating it. This, in turn, means that all values are equally probable and some certain numbers can't just be excluded from it.
- I have already used this card with a number of other online services, including Amazon Web Services, whose security is out of any doubts.
- I don't quite understand what "not secure enough" means. Are "111" or "999" secure enough? If not, how about "123" or "234"? Again, it's not something I pick myself, it's something I'm given by a bank, and if the bank thinks it's secure, then it must be treated as such.
Their response was very polite but not very helpful: "We totally understand your frustration and we are really sorry about causing you inconvenience. We handed your reasoning over to our management - they responded that 000 is considered invalid, and this is also a way banks indicate that the card is a forgery".
I forwarded the mail chain to my bank and asked for their advice. They told me they'd issue a new card for free, which solved the problem for me.
However, I still wonder:
- Are there any official regulations/prescriptions (from Visa/MC or elsewhere) or any best practices regarding "all-zero" CVC/CVV codes? Especially that bit about banks allegedly using 000 as an indication of a forgery - sounds like complete nonsense to me. I tried googling, but couldn't find anything.
- From a practical point of view, how reasonable it is to decline "000" as insecure? I listed my concerns above, but maybe I'm missing something?
Update: Tough choice on which answer to accept... I liked the answer from Alexander O'Mara a lot - it is detailed and to the point. The latest revision of Harper's answer also seems very reasonable. Yet I eventually decided to accept the answer by Zoey - it seems the most relevant, as it, besides everything else, also sheds some light on the internals of hotel business.
Thanks everyone for your answers and comments! What I'm going to do now is contact Booking.com support again and insist on getting this fixed. Will let you know about the outcome.
Update 2: After several months of trying to contact Booking.com's support I officially give up. I haven't gone any further than a countless number of support tickets that were not even confirmed, not to mention being reacted on, and a couple of phone calls where I explained the situation and got nothing but a canned email "we are trying very hard to solve your problem". Bottomline: Booking.com's support doesn't work - unless your problem is very standard, it won't be solved nor escalated to higher management.
The bug still exists. I'm now assured that it is nothing but a software bug, because CVC "000" is perfectly accepted when you add a new card, but it doesn't work when you are trying to update an expired (or otherwise invalid card). Here's the repro steps:
- Create a new booking that requires immediate payment.
- Enter an invalid card (expired or blocked).
- When the system sends a notification that the card can't be processed, select "update card details" and enter details of a valid card with CVC code 000.
Expected result: the card data gets accepted for further processing.
Actual result: the entered CVC code gets discarded and the dialog window complains that CVC code is not entered.