I've reviewed multiple threads on reasons why 000 should be allowed and why it shouldn't: All 0s (zeros) in a bank card's CVC code https://news.ycombinator.com/item?id=18768801

In summary, reasons 000 should be allowed:

  • Poor validation (validation bug) due to a lazy programmer since CVC should be a string, not an int, so this is a bug that needs to be fixed
  • If threat is brute force, a system only using values 001-998 is less secure than one using 000-999

Reasons 000 as a CVC should not be allowed:

  • Bias in guessing matters as much as bias in generation, with users who are trying to pass a fraudulent transaction will highly guess the CVC with values 000 and 123
  • A system such as a booking one will be connected to other brokers whose systems may have poor validation so 000 is blocked on purpose from the top
  • According to Bard, its response to "Is accepting a CVC of 000 considered PCI compliant?" is "No, accepting a CVC of 000 is not considered PCI compliant".

I am leaning towards NOT allowing a CVC of 000 due to it not being PCI compliant.

  • 2
    You should accept everything which is valid and reject everything which is not valid. If 000 is a valid value for a CVC, then you need to accept it - and if 000 is not valid you need to reject it. And from the experiences described in the linked question it looks like 000 is actually valid. "it may be a repetition of the first link." - Please make very clear what new aspects your question has compared to the linked on. If there is nothing which is not already handled by the previous one, then this question should be closed as duplicate. Commented May 2, 2023 at 18:33
  • @SteffenUllrich This post was in-part to bring in my 2cents(since I don't have the reputation to do anything other than post) to this subject but also to bring in the novel statement that another reason for 000 to not be accepted is due to it not being PCI compliant. Programming is more than the code. It's about the system as a whole. So if the statement that it's not PCI compliant is true then I wanted to bring it up to encourage dialogue on PCI compliance and other such externals. Personally, I think this matters more than if 000 is valid or not since our company must be PCI compliant.
    – jfar41
    Commented May 2, 2023 at 19:29
  • BUT I also saw the post on how not allowing for a value of 000 could cause a huge loss in profits. It seems like there's no hard direction as to what to do in the case of accepting 000 or not. It is starting to seem company dependent depending on how the risks to rewards stack up.
    – jfar41
    Commented May 2, 2023 at 19:34
  • "bring in the novel statement that another reason for 000 to not be accepted is due to it not being PCI compliant" - I have no idea where this statement comes from. Surely not from the link which is contained in the image. Note that things like ChatGPT (and thus also Bard) are banned on SO for a reason - since they will easily make up things including seemingly links which prove this. Commented May 2, 2023 at 20:03
  • From my understanding all your questions adds to All 0s (zeros) in a bank card's CVC code is a questionable claim created by a KI system, where the system is known to make things up. Therefore I propose to close the question as duplicate. Commented May 2, 2023 at 20:04

1 Answer 1


If someone's card has a CVC of 000 on it then obviously 000 is a valid CVC and you have to accept it, or else that person cannot buy your products.

End of story.

AI assistants and chatbots are known to hallucinate incorrect facts. They are trained to write in a way that is confident more than they are trained to provide correct facts. Do not rely on Bard's understanding of PCI DSS. Read the actual PCI DSS. Although I don't know PCI DSS, I strongly suspect it will not say 000 is invalid, and my evidence for that is the fact someone has it on their card.

  • PCI doesn't concern itself with how the numbers are generated. It just covers what you're allowed to do with them. But otherwise, this is entirely correct.
    – Bobson
    Commented May 3, 2023 at 7:00
  • 1
    @Bobson PCI DSS is written by payment card companies and that is why I doubt it says you should not process valid cards. Commented May 3, 2023 at 7:08
  • In fact there is probably something in your payment card contract (outside of DSS) that says you must accept all valid cards. Commented May 4, 2023 at 18:04
  • Yes, the card brand's merchant rules generally say you have to accept all valid cards. My point was simply that it isn't PCI DSS that would say whether or not 000 is valid. DSS is only concerned with security, not validity, so you can't take it's lack-of-statement as meaning anything other than it not being relevant. It'd be the card brand rules to issuing banks which say whether or not 000 is valid to put on a card, and the agreements with the merchants that would require accepting it.
    – Bobson
    Commented May 5, 2023 at 6:32

Not the answer you're looking for? Browse other questions tagged .