You may have noticed that when you're making a credit card purchase online or over the phone that in addition to the credit card number and expiration date, you may also be asked for the CVV. This is otherwise known as the card verification value and is an important security measure.
In this article we'll share more about the CVV and why a retailer would ask for it during a transaction.
What is a CVV?
The CVV is typically three or four digits long and printed on either the front or back of the card.
When you're not physically present at the transaction — such as online shopping or over the phone — it's referred to as a card-not-present transaction. People are more likely to attempt credit card fraud in these scenarios.
How does CVV work?
The Payment Card Industry (PCI) has prohibited merchants from storingCVVs on their e-commerce websites. This protects you in the event the site is hacked and your data is breached. Even if someone has your credit card number, if they don't have the corresponding CVV, it's much harder to make unauthorized purchases with it.
By asking for the CVV code, the merchant is adding an extra level of security to ensure that the cardmember is the one making the purchase. That piece of your credit card information is not present in the magnetic stripe. Therefore, many common fraud schemes, such as skimming, won't work.
Is there a difference between a CVV and a PIN?
A PIN is a “personal identification number" and is created by the cardholder. It is typically four digits, though depending on your financial institution, it may be longer. Credit cards require PINs to execute cash advances. Both credit and debit cards use PINs for withdrawing cash from an ATM or making a purchase. PINs are different than CVVs.
A CVV is assigned by the credit card issuer and, unlike a PIN, the CVV is printed on your card.
Which online stores don't require a CVV?
Some high-profile e-commerce sites may not require a CVV to make a purchase because they already have other reliable security measures in place and don't want to add friction to the checkout process.
Why don't some online stores use a CVV?
It's important to note that CVV numbers are not a requirement for processing an online credit card purchase. It is up to the retailer whether to ask this question as part of the transaction process as an added measure of security. There are several reasons why a retailer may not ask for the CVV.
Other security measures are in place
Some retailers may choose to skip CVV verification because they have other security measures in place to mitigate risk.
Address verification system (AVS) is an example of a verification tool that helps retailers to mitigate risk without asking for the CVV. It cross-references your address and compares it to the address on file for the card.
High risk tolerance
Some retailers simply have a higher risk tolerance than others. Depending on the size and profit margins of a certain retailer, they may decide to accept the risk of fraud or chargebacks. They're able to eat the cost and create a more seamless customer experience with no added friction during the checkout process.
Payment management system is in place
Some retailers allow customers to use payment management systems that store your credit (or debit) card information for you.
Most prominent examples are Apple Pay, Google Wallet and PayPal. When these platforms are used to make a purchase, the payment management system handles verification and processing, so the online retailer doesn't see or obtain your credit card information.
In these examples, the CVV is likely on file with the payment management system, so you aren't required to enter it again to make a purchase. The CVVs are never kept on file by the retailers themselves.
Previous customers are verified
Some retailers will only ask for your CVV the first time you make a purchase with them. If your transaction goes through successfully, your item(s) are delivered and there is no report of fraud, the retailer may assume that you are a genuine cardholder making a purchase. The next time you shop with that retailer online, unless you change your card number or shipping address, they may assume that you're the true cardholder and may not need to ask for the CVV.
In conclusion
When an online merchant asks for your CVV, it's a sign they are being diligent about fraud protection for both you and themselves. CVVs act as an extra layer of security measure when you're not physically present during the transaction, as you would be when shopping at a brick-and-mortar store.
