On some internet banking websites, I've seen some CVV input fields that seem strange to me. Here is an example:

Example CVV input type that I am referring to

The field works as such:

  1. You can not input a CVV code using a keyboard.
  2. The numbers are never in their normal order (1, 2, 3...).
  3. The positions of the numbers are shuffled each time you open the CVV input panel.

So my question is:

Is there a point in making the numbers shuffled each time you want to input a CVV code?

I understand that you might want to disable the keyboard input and use a mouse instead to defend from keyloggers, but is there any point in making the positions of the numbers shuffled?

I do also understand that this approach is a good idea on a touch display as it removes the posibility of guessing the pin by the fingerprints on the display, but the cursor does not leave any fingerprints behind.

And if this is made to defend from keylogers that also log your mouse clicks, is it actually effective, knowing that if the keylogger logs your mouse clicks, there is no reason it can not also make screenshots?


All your suspicions are correct:

  • it is meant to defeat keyloggers
  • it is meant to defeat touchscreen fingerprints
  • it is meant to defeat mouse loggers (you can derive the number sequence from the relative position of the mouse when it clicks)
  • it will fail against loggers that take a screenshot when the mouse is clicked

Is it actually effective? Well, it depends on what the threat actually is. It is effective against the threats that it is effective against and weak against the threats it is not designed to defend against.

Which threat is more likely? That's not always easy to guess. I'm not sure that any are likely at all. Those are not the types of threats that are dominating right now.

But what this does do is to make it look like the site is "really secure" for implementing such an extreme measure.

  • the last point might not be true if there's no visual feedback from a "click" on the number. It also prevents the low-tech dirty fingerprint leaking of combinations.
    – dandavis
    Dec 14 '20 at 18:09
  • @dandavis there need not be a visible indicator. The mouse-logging software hooks into the mouse event handler. The screenshot is taken when the mouse clicks.
    – schroeder
    Dec 14 '20 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.