From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has all the information on the front side of the card (card number, holder name, expiry date) but not the CVV?
The only fields required to charge a credit card are the number (also called a PAN or personal account number), the expiration date, and an amount. Without the CVV it is still very possible to charge the card.
Many merchants will require the CVV and/or postal code as basic anti-fraud mechanisms. There is also an incentive for many merchants as providing these can qualify them for lower interchange rates, the service fee paid by merchants to the card network.