Log in

No account? Create an account
CVV2 Questions - brad's life — LiveJournal [entries|archive|friends|userinfo]
Brad Fitzpatrick

[ website | bradfitz.com ]
[ userinfo | livejournal userinfo ]
[ archive | journal archive ]

CVV2 Questions [Nov. 25th, 2003|11:30 am]
Brad Fitzpatrick
The Internet is useless. I want to know why CVV2 codes on credit cards are supposed to be more secure and help consumers. Every website just tells me, "It protects you". But why?


1) it's not embossed, so employee crooks at stores swiping cards with carbon paper don't get the CVV2 number.

2) it's not part of the hashing function within the card's primary 16 numbers, so even if you use a credit card generator program (trivial to write), you can't get correct CVV2 numbers, since only the card issuer has it.

3) merchants aren't supposed to store CVV2 numbers? So if their databases are hacked, nobody gets those? No... because I know Amazon and many others do.

I don't really think (1) and (2) happen much anymore compared to databases being hacked (3), and since everybody just puts CVV2 numbers in their databases, how does CVV2 really help?

Enlighten me!

[User Picture]From: supersat
2003-11-25 08:04 pm (UTC)
The CVV2 value is also not stored on the magnetic stripe at all (and thus, is never printed on any receipts), so it's impossible for a retail store or employee to steal your CVV2 with just swiping your card. It'd be awfully suspicious if an employee wrote down the CVV2 value from the back of your card.

CVV2 values also change unpredictably when a card is reissued. Usually, when your card expires, you just get a new one with the same account number and an expiration date a couple of years from your original expiration date. This cuts down the window of potential abuse if someone stole your card number and CVV2 value.
(Reply) (Thread)