CVVS on credit cards, Security questions, etc... - GoFuckYourself.com

goBigtime · 08-13-2003, 07:45 AM

Man Alive.

I haven't done much e-commerce outside of tons paypaling in a long time.

But I just registered for Western Union and sent someone some money....

The CVVS thing (the 3 digit number on the back of the card) is a joke -- I write "ASK FOR ID" in permanent marker on the back of my cards... so I can barely read the code, and on a couple cards it was scraped off from keys or change or something.

Yet, without that CVVS2 number I wasn't about to do anything with that card.

But my point here is... what good is this information really?

If someone compromises their databases they will have it all anyway? CVVS/2 seems like a joke to me.

They also forced me to select a security question and gave me three commonly used choices of:

Mothers maiden name
Pets Name
And something else that I forgot.

Another bad idea - to lock people into answering the same security questions over and over.

For example: If someone got this database, they might be able to change my hotmail information because they know the answer to say, my Mothers maiden name...

So then they could go change my hotmail address because hotmail suggested I use my mothers maiden name too. (as an example - I didn't really do this obviously)

From there they could access/damage a ton of other things.

sperbonzo · 08-13-2003, 08:05 AM

Actually, Visa Regs say that any CV2 info collected must be purged after the sale is settled. So it shouldn't be on a database.

It's not supposed to be, anyway. Any above board processor or gateway follows these guidelines.

abdab_1 · 08-13-2003, 08:09 AM

Just to throw my hat in to the ring on this one, any Cards without CV2 nuimbers should only be processed in a 'Card Holder Present' Situation.

Granted this is not always the case however we have been told this is the case. I dont know of ant Credit Cards without these numbers however there are many Debit Cards which do not have a CV2 number.

EscortBiz · 08-13-2003, 08:09 AM

well cvv2 does not stop people who do this for a living, its simply an algo and whatever good guys have access to bad guys can get access to as well

rowan · 08-13-2003, 11:28 AM

Quote:

Originally posted by goBigtime
The CVVS thing (the 3 digit number on the back of the card) is a joke -- I write "ASK FOR ID" in permanent marker on the back of my cards...

This sounds like a great idea... but can't you remove permanent marker ink from plastic with a bit of alcohol?

Maybe it could be engraved if the plastic burrs could be cleaned up?

My signature seems to change fairly frequently - even in the last 2 months since I signed my newest card - but I've only been ever asked for verification ID once...

detoxed · 08-13-2003, 11:35 AM

Quote:

Originally posted by EscortBiz
well cvv2 does not stop people who do this for a living, its simply an algo and whatever good guys have access to bad guys can get access to as well

But its different for each bank, so hackers are limited. Same for DIS data on the mag stripe of credit cards... it can be hacked so someone can turn a credit card # and exp date into a real plastic card... but each bank would have to have their DIS data cracked seperately. Several have already been cracked.

goBigtime · 08-13-2003, 11:36 AM

Quote:

Originally posted by rowan

This sounds like a great idea... but can't you remove permanent marker ink from plastic with a bit of alcohol?

Doh. You've just ruined my false sense of security

Actually it hardly matters.

$6/hr employees rarely care who's doing what... I might get asked for ID 10% of the time.
(and it's BIG and BOLD on the back of the card - ASK FOR ID.)

Nobody cares. It's an ongoing theme

Thee Johnclave · 08-13-2003, 11:46 AM

sperbonzo is correct... CVV2 must not be stored as per Visa regs.

That said, the number appearing in the "signature strip" on the back of the card is a definite PIA. I have a Visa which is about 2 months old and the last number is almost completely scratched out. Amex display's theirs on the front of the card. Much better, IMO.

Kimmykim · 08-13-2003, 11:56 AM

cvv2 is definitely not supposed to be stored. It was designed to be an additional security measure for card not present transactions, and it does work to some degree. Biggest problem is the banks that issue cards that do not support it, I dont even know why they print it on the card.

psyko514 · 08-13-2003, 06:43 PM

basically, just like everything else with visa, the banks are given a deadline in which to implement certain things. much like verified by visa, chip cards and not printing full card numbers on receipts.

most banks issue a CVV because it's easy to do, but they won't support verifying the info until they have to.

08-13-2003, 07:45 AM	#1
goBigtime Confirmed User Join Date: Nov 2002 Posts: 7,761	CVVS on credit cards, Security questions, etc... Man Alive. I haven't done much e-commerce outside of tons paypaling in a long time. But I just registered for Western Union and sent someone some money.... The CVVS thing (the 3 digit number on the back of the card) is a joke -- I write "ASK FOR ID" in permanent marker on the back of my cards... so I can barely read the code, and on a couple cards it was scraped off from keys or change or something. Yet, without that CVVS2 number I wasn't about to do anything with that card. But my point here is... what good is this information really? If someone compromises their databases they will have it all anyway? CVVS/2 seems like a joke to me. They also forced me to select a security question and gave me three commonly used choices of: Mothers maiden name Pets Name And something else that I forgot. Another bad idea - to lock people into answering the same security questions over and over. For example: If someone got this database, they might be able to change my hotmail information because they know the answer to say, my Mothers maiden name... So then they could go change my hotmail address because hotmail suggested I use my mothers maiden name too. (as an example - I didn't really do this obviously) From there they could access/damage a ton of other things.

08-13-2003, 08:09 AM	#3
abdab_1 Confirmed User Join Date: May 2003 Location: Leeds, UK Posts: 425	Just to throw my hat in to the ring on this one, any Cards without CV2 nuimbers should only be processed in a 'Card Holder Present' Situation. Granted this is not always the case however we have been told this is the case. I dont know of ant Credit Cards without these numbers however there are many Debit Cards which do not have a CV2 number. __________________ <p><a href="http://support.nochex.com/adult/" target="_blank"> <img height="60" src="http://support.nochex.com/web/gfx/adult_anim_cards.gif"width="120 " border="0"></a></p> Convert All Your Traffic!

08-13-2003, 08:09 AM	#4
EscortBiz Fuck Checks, CASH only! Join Date: May 2002 Location: New York City Posts: 19,422	well cvv2 does not stop people who do this for a living, its simply an algo and whatever good guys have access to bad guys can get access to as well __________________ Spanking, Medical Fetish, Sleeping, Strap-on Anal Lesbians, Girls Fucking Guys, Handjob site REAL HOT, Shemales, Anal and Ass Licking sites 100% Real EXCLUSIVE with amazing retention, ccbill payouts, lots of content FREE FTP HOSTING Promote the largest and oldest member paid escort site, Converts 10 times better then any dating site, CCBill payouts ICQ# 158802076

08-13-2003, 11:46 AM	#8
Thee Johnclave The Billz Collectaz Join Date: Nov 2001 Posts: 632	sperbonzo is correct... CVV2 must not be stored as per Visa regs. That said, the number appearing in the "signature strip" on the back of the card is a definite PIA. I have a Visa which is about 2 months old and the last number is almost completely scratched out. Amex display's theirs on the front of the card. Much better, IMO. __________________ Seeking large traffic deals. john at pptme dot com

08-13-2003, 06:43 PM	#10
psyko514 See sig. Join Epic Cash. Join Date: Oct 2002 Location: Montreal, Quebec. ICQ: 214702014 Posts: 22,366	basically, just like everything else with visa, the banks are given a deadline in which to implement certain things. much like verified by visa, chip cards and not printing full card numbers on receipts. most banks issue a CVV because it's easy to do, but they won't support verifying the info until they have to. __________________ Bad Girl Bucks - 50% Revshare through CCBill. Promote BrandyDDD, Pixie's Pillows, Action Allie and more! Phoenix Forum Pics \| Webmaster Access Montreal pics email: psyko514(a)gmail.com \| icq: 214-702-014

08-13-2003, 08:05 AM	#2
sperbonzo I'd rather be on my boat. Industry Role: Join Date: May 2003 Location: Miami, FL Posts: 9,748	Actually, Visa Regs say that any CV2 info collected must be purged after the sale is settled. So it shouldn't be on a database. It's not supposed to be, anyway. Any above board processor or gateway follows these guidelines.

08-13-2003, 11:56 AM	#9
Kimmykim bitchslapping zebras!!!!! Industry Role: Join Date: Jun 2001 Location: In a shack by the beach Posts: 16,015	cvv2 is definitely not supposed to be stored. It was designed to be an additional security measure for card not present transactions, and it does work to some degree. Biggest problem is the banks that issue cards that do not support it, I dont even know why they print it on the card.