CVV (Card Verification Value) codes are either three or four-digit numbers that are printed on either the front or back of credit and debit cards. This system was created to provide an extra layer of security to merchants and card-issuing banks against fraudulent transactions in card not present purchases.
Two Types of Codes
These codes come in two different forms: CVV 1 and 2. The CVV1 is integrated into the magnetic strip on the back of every card. In a retail, or other card present environment, where the card is physically swiped through a reader, the first CVV is used to verify the data on the track 2 mag strip is legitimate and matches up with the information the issuing bank has on file.
The second, and some might argue more important type, is the CVV2. Just to clarify, Visa and MasterCard use the three-digit CVV2 number printed on the back of the card next to the signature line. American Express uses a four-digit “Unique card code” that is located on the front of the card. Regardless of location or length, these both serve the same purpose: to prove that the person making the purchase has the original and real card in their possession.
Skimming and Fraud
The CVV2 code is commonly requested by merchants in purchases over the Internet or in MOTO (Mail Order, Telephone Order) transactions. If a fraudulent card has been produced from a skimming device, the thief will not have the CVV2 number as it is only physically printed on the card and not stored electronically. Skimming is the practice of attaching a device over the top of a real magnetic strip reader, usually on ATMs or gas station pumps, to gather the sensitive information about the card. This information is used to make fraudulent cards and/or purchases.
If a thief attempts to make a purchase with a stolen card and does not have the CVV2 when the merchant requests it, the transaction will not be approved. The problem is that according to a recent study, only around 56% of online merchants request the CVV2 in order to complete transactions. Also, if a business does require the code, they can see around a 25% reduction in chargebacks.
The Bottom Line
It is important for consumers and merchants alike to protect sensitive information about their debit and credit cards. If a thief has your name, card number, expiry information, and CVV code they can very easily make fraudulent purchases or even create a duplicate copy of your card. For consumers it is important to ensure the business you are purchasing from is legitimate. For businesses, it is critical that proper procedures be followed when recording and storing your customers’ sensitive financial data.
