CVV2 Paranoia

[Angry_Hippie]

I've been discussing this increasing issue with coworkers lately. Most of our clients except our biggest one (we're a multi-client call center) require all orders to have the CVV2 (the little 3 digit on the far right of the signature strip on most cards (4 digit on front of AMEX)) along with the matching billing name, address, and phone number. This is a security measure to make reasonably sure the person using the card is the cardholder and the point of the CVV2 # is to make sure the card is actually present.

One of a newer clients skews a touch older and upper middle class (people who probably watch tons of televised news programs but don't use the internet much). We are getting LOTS of people who when I ask "May I have the card verification number?" they respond in some way letting me know they don't feel comfortable giving that. They say crazy things like "I've heard you should NEVER give that number to anyone ever", "My credit card company says to NEVER give that number out", "you don't need that", "My card doesn't have one".

My coworker helped make sense of it for me "Don't blame me, its the MEDIA" (sorry Chris Rock :-).

In classic news style it seems like they are giving half the story, yes it is a great idea to be careful who you give the CVV2 number to, but its stupid to translate that good idea to never give it to anyone.

If it wasn't supposed to be given or used ever it wouldn't exist! I try to explain that I can put the order through without it but most likely it will not go through an you will get a phone call in 24-48 hours telling you so.

Some genius yesterday tried to get me not to ask her for her CVV2 with "Why do you need that? stores never write down that number!" I explained how its to protect her and the reason the store doesn't use it is because they don't need a number to prove the physical card was present, they have the magnetic strip that isn't there if the the card isn't present. We ended up selling her a gift card in the store and I took the gift card number over the phone.

I have the sense these are the same people that fall for actual scams. I wish I could direct them to wikipedia. http://en.wikipedia.org/wiki/Card_Security_Code

[RedRoseSpiral]

I'll admit to not wanting to give out the number but only in a few cases. Once I had ordered some clothes off of Hot Topic's website and a few days later I got a call on my house phone. It came up very weird. It was weird to me because I have had them call before and it was something totally different and more professional looking on my caller ID. The guy had a thick accent and it was very hard to understand him but it was very clear he wanted those numbers. I did give them out because I wanted my shirt (limited time online only Rob Zombie t-shirt ), but I did check up with my bank to make sure things were legit. I pretty much got called an idiot by the woman on the phone. Hell, she had no clue what I was talking about. I ended up hanging up on her. Luckily, things were legit and I got my shirt.

[depechemodefan]

I'll admit to not wanting to give out the number but only in a few cases. Once I had ordered some clothes off of Hot Topic's website and a few days later I got a call on my house phone. It came up very weird. It was weird to me because I have had them call before and it was something totally different and more professional looking on my caller ID. The guy had a thick accent and it was very hard to understand him but it was very clear he wanted those numbers. I did give them out because I wanted my shirt (limited time online only Rob Zombie t-shirt ), but I did check up with my bank to make sure things were legit. I pretty much got called an idiot by the woman on the phone. Hell, she had no clue what I was talking about. I ended up hanging up on her. Luckily, things were legit and I got my shirt.

I can imagine you getting your shirt anyway since this guy with the accent probably never was connected with Hot Topics. But if you weren't charged for things you never bought, then maybe he was with Hot Topics.

[RedRoseSpiral]

I can imagine you getting your shirt anyway since this guy with the accent probably never was connected with Hot Topics. But if you weren't charged for things you never bought, then maybe he was with Hot Topics.

Yeah, that's what I figured. If there had been I would have fought it especially since I called the bank and they keep record of calls about accounts and all that.

[JLRodgers]

My web host company had a comment about the extra numbers: They're useless.

Why? Well it doesn't prove you have the card - only you've seen the card once (since you could write down the numbers just as easily as the ones on front). No security there at all -- it's just something to give a false sense of security.

[Bright_Star]

You know what? It's a good thing to be cautious but when it starts interfering with the way you conduct your life then it's time for a reality check. There is such a thing as being TOO cautious. At some point you have to have a little faith & trust. IF you don't then you may as well go crawl under a rock in the fetal position whimpering that "they're coming to get me, omg!"...lol.

[zigcat]

This guy who ordered a pizza and paid by credit card AND reluctantly gave me his cvv2 code actually had the audacity to ask me if I were going to take his information to go on a shopping spree!!

Let me get this straight, sir. You call up a place of business, you place an order, I give you two options of payment, cash or credit. YOU opted for credit. In so doing there is a procedure that I have to follow because you're not here to present your card. God knows if I DIDN'T follow that procedure and something happened you'd be all over our asses!
So, if you have a problem or feel a need to call my honesty into question, I'll be more than happy to cancel your transaction and you can pay cash when the driver arrives!

(didn't actually say that to the guy; didn't think of it until way after it was over)

[Angry_Hippie]

Now I want a limited edition Rob Zombie shirt :-)

I'm super cautious but in ways that make sense. When I am the one calling the merchant have gotten the number from a first hand source and trust the company cvv2 no problem.

If I was getting a callback from a company that "all of a sudden" needed the cvv2 I'd be a little wigged. Its too close to the most common cvv2 scam which is get basic credit card info (name/address/phone/card number) call pretending to be "security department" for the credit card company. Get cardholder worried with a story and have them give cvv2 number. now card info is useful more places online.

IF you ever get someone calling you asking for those numbers 1) copy number from caller id (may need it for cc company or police later) 2) do NOT give cvv2 3) ask the caller who/what they are affiliated with (retailer you deal with, bank) get a name/department/employee number 4) end call right then 5) find a first hand trusted number to call claimed retailer/bank at and ask them about the call you just received (for example get thick accent mans name and department, call hot topic's 1800 # and deal with them)

I for one DON'T think cvv2 is useless. Not at all foolproof, but they help somewhat. Most methods of getting a card number (hacking records, dumpster diving, imprint machine, copying the magnetic strip) will give you name/address/phone/card number at most. The cvv you have to have seen card at some point in time, doesn't appear on bills, is not documented on mag strip, and by law can't be stored after transaction is authorized and approved by the bank.

[fish3k1]

I for one DON'T think cvv2 is useless. Not at all foolproof, but they help somewhat. Most methods of getting a card number (hacking records, dumpster diving, imprint machine, copying the magnetic strip) will give you name/address/phone/card number at most. The cvv you have to have seen card at some point in time, doesn't appear on bills, is not documented on mag strip, and by law can't be stored after transaction is authorized and approved by the bank.

Agreed. Sure, it's not perfect, yes if you've seen the card you can copy the numbers. But if you haven't seen the card, you're screwed. Even a little security is better than no security (so long as people understand the limits of what their security systems are capable of).

[calulu]

I have problems with people not wanting to give out the cvv2 code either but I just evilly override the programming in our evil companys software, force it to go through.

Don't know why people act like it's a state secret because there are almost no places online that allow you to buy without using that same code.

[Andara Bledin]

Just an FYI on not getting the security code: You are costing your company money.

I'd suggest you stop overriding your company's "evil" software because it's effecting the bottom line, which effects your paychecks in the long run.

As an example, my company's credit card processor charges about 3.5% on transactions (not an exact figure). If we don't get the CVV2 code, we get charged about 5.5%. That can add up to a lot of money burned for pure lazyness and paranoia.

^-.-^

[calulu]

I only care about my commission.... *makes evil handwashing motions and laughs 'bbbwwhahahahah, my first step in taking over the entire world!"

We're actually told to override the software when that happens. You try to get the code but if it's not happening we're told to do whatever, and I mean whatever, to get the sale.

[JLRodgers]

Agreed. Sure, it's not perfect, yes if you've seen the card you can copy the numbers. But if you haven't seen the card, you're screwed. Even a little security is better than no security (so long as people understand the limits of what their security systems are capable of).

My cvv2 number has actually been printed on the notices sent in the mail (might of been a coincidence.... but they send me my account #, and it's sometimes listed at the end). When I got the card, it was printed (by a rub-off printing) on the paper.

[bean]

Then you have people like my dad.

He's normally very intelligent, and since he's an accountant, deals with money daily.

He absolutely refuses to pay for anything online or over the phone with a credit card. But he's more than willing to do a check by phone.

It's far, far easier to dispute a credit card charge (even if it's a debit card transaction). If you give out your account and routing numbers, someone can go to any check printing company and have checks issued on your account.

If someone gets your CC number... eh, usually it's a call to the bank to dispute the transactions and a request for a new card. If someone gets your banking info, you can get cleaned out in short order with little recourse.

[fish3k1]

My cvv2 number has actually been printed on the notices sent in the mail (might of been a coincidence.... but they send me my account #, and it's sometimes listed at the end). When I got the card, it was printed (by a rub-off printing) on the paper.

Wow... that... that just sounds like bad practice from the bank/cc company. I'm more or less speechless.