Credit Card Security Digits

Apr 11, 2006 7 Replies

The final 3 characters appearing on the reverse of the card. What is the purpose of these?



Since they are now routinely requested for postal and telephone (as well as online) transactions, any value as an additional security measure is (presumably) very limited.



These details in combination with the other credit card details, customer address and the service or items being purchased are going to be known to any number of call centre and other clerical staff across the country or overseas, fertile ground indeed for potential ID theft.



Incidentally, there is presumably an algorithm that computes or validates the security digits against the card number itself, or do the merchants validate the details directly with their bank?


They are to prove that the actual card is in the shopper's possession. The point is that these figures are never printed on transaction receipts, and therefore the genre of fraud eliminated is that of people rummaging through bins for such receipts.

They ought to be required *only* for phone and online transactions, and

*never* for postal ones. The whole point, surely, is that they should never be written down, and cannot therefore be stolen.

True, but there is a presumption that such staff will be vetted and considered safe. Such folk may well still transgress, but it'll be more than their job's worth if they do.

I'd guess the code is validated direct with the issuer each time.

Note that when an expired card is re-issued, it will have a different

3-digit code even when the 16-digit card number stays the same. This means that either there cannot be such an algorithm as you suggest, or else the code is not unique, or else (most likely) the algorithm takes in more than just the card number. For instance, it might take in the validity dates.

"Ronald Raygun" wrote

Why? How would anyone show that it was *them*, rather than any of the *other* "call centre and other clerical staff across the country or overseas"?

This may have been the original reason but since the full card number isn't generally printed on receipts now (here or abroad), the ability to determine a card number from bins is much reduced. The three digits (4 for Amex cards, conveniently printed on the front of the card for photocopying!) are now routinely requested by all and sundry - so as to make the system much less secure.

I recently received some mail which (if I had wanted to buy what they were selling) requested the security code on the form you sent them. It was on a corner which they promised to cut off and destroy when they had done the card security processing but I'm not sure I'm very keen on same.

That's outrageous. The letter could have gone "missing" in the post.

What do CC T&Cs generally say about how freely you may reveal this code number?

Well, if they use the numbers to buy stuff for themselves, they'll be found out in the fullness of time, won't they?

If, on the other hand, they sell the numbers to others, then those others will first need to be found, and then, I suppose, a certain amount of torture will be required to get them to reveal their sources.

Also, what is the purpose of the other digits back there? I've got seven digits on my card and have never used the first four for anything.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required