Item — HN Reader

What makes the security code (CVV) different from just having more digits is that you (the site/merchant) not allowed to store it permanently in your database. You can keep it in-memory for up to 15 minutes while authorizing the transaction.

That means in theory, if the merchant's credit card database gets hacked, the fraudsters will get access to the credit card numbers but not the CVV.

In practice, the rules aren't obeyed as strictly as they might, so you can easily find credit cards with CVV on the black market.

2 comments

Even if the different fields have different security requirements, that doesn't seem to be a good reason to require them to be entered separately.

I don't really care if someone mandates that digits 1-4 can be sent via email, digits 5-10 can be stored unencrypted, digits 11-16 must be encrypted, and digits 17-20 can never be stored at all. They're still just digits/bits of information, and I have to provide all of them almost all the time anyway.

The one exception is when a retailer has saved my credit card number, in which case they might ask me for the CVV only. But I'd rather that they didn't save the card number at all! I have to look up the CVV and copy and paste it into their form every time anyway--so they may as well require the whole thing every time.

Compatibility is a valid reason. You really can't change any parts of a system with so many participants in every country worldwide - you can only add new layers to it.

For those who are interested, this is what I am told is one of the original reasons for inventing the CVV value. Back in the olden days credit card transactions were processed and verified by taking an impression of the card and the raised numbers on the front of the card. To prevent merchants, and/or employees of those merchants from taking credit card numbers off of the impressions and using them to make over the phone transactions (or any transaction where the card is not physically present), the CVV value was created. This is why the CVV value is printed on the back of the card, or if it's on the front of the card then it's not printed on raised type, so that the CVV number will never show up on credit card impressions. This is why the CVV number is often referred to as the "credit card not present" number, and is usually required when making transactions where the card is not physically present to the merchant.