CVV is a security feature.

Why isn't it handled as a PIN and kept secret? I see that's convenient to have the number on the back (or front, in some rare cases), but so would be to write your PIN on your bank cards.

  • 2
    If you're interested in payment security, I recommend reading up on either Apple Pay or Google Pay (I've not yet myself, I plan to). I would expect that they're designed pretty well, while the card payment system is essentially a catalogue of mistakes that we're stuck with as legacy. – paj28 Oct 19 '19 at 16:05

Because it adds security without any significant burden on users.

Before CVV2 was introduced (around 2000), most transaction records contained all the information someone needed to commit fraud. These could be receipts, till logs, transaction databases, etc. With CVV2, merchants are banned from storing it, so it reduces a lot of sources of fraud. The CVV2 is not on the mag stripe, but there is another code (CVV1) that is.

You probably also have a PIN for your card, but that's a different security mechanism. For example, I would never input my card PIN when making an online transaction.

| improve this answer | |
  • I don't think I've seen a receipt with a CC# on it since the 80s. Also, the CVV2 is specifically NOT on the mag stripe. Maybe you're thinking of CVV1? Not putting it on the magstripe is actually part of the security of the system, trying to keep it from being stored. en.wikipedia.org/wiki/Card_security_code – Steve Sether Oct 19 '19 at 16:15
  • @SteveSether - Sorry, I have conflated CVV1 and CVV2. In the UK receipts (and statements) commonly had full PAN up to early 2000s – paj28 Oct 19 '19 at 16:19

CVV is a security measure in that to know it, you have to be in physical possession of the card (or be able to view it in some other way) to get it. A card being skimmed won't contain that, so it would only be used in systems that don't ask for the CVV. I agree that it should be kept secret, not printed on a card, but I also think all cards should be smartcards that provide virtual numbers and CVV numbers per transaction/merchant, like how things like Privacy.com, Apple Pay, Samsung Pay, and Google Pay work.

As for your question of why it's NOT like that, you'd have to ask the credit card companies. Everything else is just a guess.

| improve this answer | |
  • 1
    Nitpick: you don't have to be in possession of the card. It's enough if you can see/film it from both sides. Anyway, it seems that it's an old way of making things, that do not work anymore. – Quora Feans Oct 19 '19 at 15:39
  • @QuoraFeans True, but you got the point. – Jesse P. Oct 19 '19 at 15:40
  • No, he completely missed the point. And telling the OP to ask somewhere else is not an answer, – Ljm Dullaart Oct 19 '19 at 18:18
  • @LjmDullaart Who said to ask somewhere else? – Jesse P. Oct 19 '19 at 18:36
  • @ jesse P. :Read your own answer; it clearly states: "you'd have to ask the credit card companies." that is: somewhere else. So, you said to ask somewhere else. And the point is that it should not be stored in the merchants database, where creditcard numbers might be. It is a safeguard against stolen merchants databases, not against skimming, not against physical possession etc. – Ljm Dullaart Oct 19 '19 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.