2

I am a newspaper circulation manager and a subscriber just informed us that we aren't allowed to ask for the CVV over the phone or by mail subscriptions. What is the correct procedure?

Improve this question
0

1 Answer 1

Reset to default
6

The subscriber was wrong. From PCI DSS 3.2.1: "The purpose of the card validation code is to protect "card-not-present" transactions—Internet or mail order/telephone order (MO/TO) transactions—where the consumer and the card are not present." You aren't allowed to store the CVV number, but you are expected to enter it into a virtual terminal when processing phone payments, for example.

Improve this answer
1
  • 1
    There is a serious dose of irony in this (correct) answer. The scenario for which the subscriber said "you can't use CVV!" is the very scenario that CVV was designed for!
    – dwizum
    Apr 15, 2019 at 16:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .