31

Two nights ago I made a purchase from a website, and it didn’t ask for my CVV. Now, I woke up to an email asking for it. It hasn’t gone through my account yet. Is this as shady as I’m making it out to be?

Here is the text of the e-mail message I received:

Dear Katelyn,

We are ready to process your order but we need the additional three digits located on the back of your credit card on the strip where you sign your name. Please supply us with this number so that we can expedite your order.

smci
  • 194
  • 8
Kat
  • 311
  • 1
  • 3
  • 3
  • 1
    Welcome new user - tell us in general what type of thing is sold on the web site? Just generally speaking. – Fattie Jul 14 '20 at 11:38
  • 34
    @Fattie Why? Would that significantly affect recommendations in handling this email? Genuinely curious. And new user is named Kat. – maxathousand Jul 14 '20 at 13:50
  • 8
    @maxathousand - my thinking was, many product categories are much, much, much more scammy than others. – Fattie Jul 14 '20 at 13:59
  • Could you contact the company by other means to confirm that the email is from them? – Quora Feans Jul 15 '20 at 05:34
  • @maxathousand Why not? Can you give one good reason not to? Generally when asking for help, it's good to provide as much information as is reasonable and relevant. The asker posted the question on the public internet. We are not invading their home asking what they're spending money on. We have reason to ask. – user91988 Jul 15 '20 at 20:20
  • @maxathousand Actually, the new user is named Katelyn. – trolley813 Jul 16 '20 at 08:31
  • Since the merchant is not allowed to store the CVV sending it via email makes it impossible for them to ever proove they didn't store it, accidentally or on purpose – Tobias Kienzler Jul 16 '20 at 09:43
  • Speak to your card-issuer, immediately.

    Using cards in person or by post, by phone or by WWW since before CVV evolved I don't recall a vendor re-contacting me like that.

    Why would they. Security requires websites not to complete check-out with details missing… Imagine "Would you like to Enter your CVV, or is that too much trouble just now?"

    Incomplete orders are normally held for a short time; prolly not more than 24 hours, giving the buyer a chance to log back in finish the transaction.

    Long before two days the sale should "die" and it's rarely a real nuisance to start another.

     – Robbie Goodwin Jul 16 '20 at 20:48

8 Answers8

88

DO NOT respond directly to the email with your information.

I cannot stress that enough: DO NOT respond to the email with any valuable information. If you decide to send them the CVV number to process the order, go to their website (do not click on a link in the email), and reach out to them using a customer service email or "Contact Us" number and ask them directly if they have requested this information. If they did, call them over the phone and share the CVV that way, rather than in an email.

This sounds like it could be phishing, where a scammer pretends to be someone you've done business with, and asks you for information that can be valuable. Usually it's for a bank user name and password ("Your password has been compromised. Click here to reset!" -- Never ever click there). If we're honest, I don't think this is phishing (a scammer would need your CC details for the CVV to be of any use), but it could be and it's important to develop safe habits.

A merchant uses that code to process the payment and verify possession of the card if they aren't handed the card in person (i.e. internet purchases). So if they didn't ask for it before, that was probably a mistake and at the very least opens them up to more liability. If they're new to accepting credit card payments, it's possible that they're still figuring everything out and it's an honest mistake. But that's the sort of thing they really should figure out after running a couple of orders (of course, a scammer would have that figured out too, so I wouldn't consider that a red flag per se). (NB: Apparently, the requirement isn't as strong as I originally thought (see comments), but I would consider needing the CVV the norm)

I might be willing to give them a benefit of the doubt if it's a new and small operation (and more businesses have become internet based the last few months for obvious reasons), but I'd be extremely wary of responding directly to the email with any personal or remotely valuable information for the reasons stated above. Reach out to the company directly through the website to confirm, preferably with a phone call. It's not perfect, but much more secure with hopefully just a little more effort.

PGnome
  • 2,280
  • 12
  • 11
  • 28
    CVV is actually not required for internet purchases, even though, in practice, every legitimate place does use it. Maybe you got confused because you cannot store a CVV number? But transactions can go through without CVV or even with the wrong CVV. Source: I use Stripe and you can disable the rule that blocks payments without or with the wrong CVV. No idea what use case would be but it can be done. – Bakuriu Jul 14 '20 at 05:51
  • 34
    @Bakuriu The most notable example I'm aware of is that Amazon does not ask for the CVV. It pushes more of the cost to them in the event of fraud, but they consider it worthwhile to reduce the friction of checking out and increase customer conversion.. – Chris Hayes Jul 14 '20 at 06:19
  • 2
    "Your password has been compromised. Click here to reset!" That sentence is about similar to most password reset we get from online services though, when we intentionally click forgot password. – user17915 Jul 14 '20 at 06:24
  • 3
    @ChrisHayes Surely the friction of the CVV is insignificant compared to the friction of all the other data? – user253751 Jul 14 '20 at 11:12
  • 1
    When I provide credit card info as a security, such as when booking a hotel or rental car, they don't usually ask CVV either, yet in the case of a no-show, I assume they can still charge me. – gerrit Jul 14 '20 at 11:20
  • It's 15 years since I worked in payment processing, but back then the vendor would submit the CVV number and the numeric portion of the customer's postal/zip code and then get a return code that said which of them matched, and then it was up to the vendor whether to proceed or not.

    Once a vendor such as Amazon has verified the CVV and postal code once, there's strictly no need to do it for subsequent purchases.

     – Alnitak Jul 14 '20 at 11:23
  • 17
    @user253751 Amazon can tokenise most of the card data for the purpose of a repeat transaction, but keeping CVV is strictly forbidden. If they're prepared to take the additional liability, they can opt to re-use the saved card token and submit it without the CVV, meaning they don't have to ask the user to input any card information at all, so it becomes effectively frictionless. – David Fulton Jul 14 '20 at 13:18
  • @DavidFulton I thought that was pretty normal - not unique to Amazon. Many places ask for the CVV on the first transaction, and then not after that, if you choose for them to remember your card details. – user253751 Jul 14 '20 at 13:19
  • 14
    @user253751 The effort of getting the CVV can be immense, comparitively. Safari (and maybe other browsers) will happily store and auto-complete (if I want) my name, shipping address, card numbers, and expiration dates. I can completely fill an order form with a couple auto-complete prompts. Providing the CVV requires getting up and locating the actual card, since my wallet is basically never in my pocket when I'm sitting at a computer. – nobody Jul 14 '20 at 13:19
  • @nobody but usually it's "[pay with same card as last time] [enter card details]". Click the left button, no auto-complete, and also no CVV. I don't know about Amazon specifically. – user253751 Jul 14 '20 at 13:20
  • @user253751 It's quite common, but it depends on the merchant's attitude to risk. They're liable if the subsequent transactions are disputed so if someone logs on to your Amazon account and successfully completes a purchase using your saved card without supplying a CVV, that's their problem. Chances are they'd ask for a CVV if you put a new address in at the same time. – David Fulton Jul 14 '20 at 13:23
  • Okay, so its not always down to the merchant; Amazon is an exception to the case because they do so many transactions they have an unique view on who you are and your home address (i.e. whether you are who you say you are). Individual merchants may have to take the CVV as required by their processors to reduce the risk of fraud - so 'optional' is a very fluid term, like saying 'the PAN is optional, you could write a cheque'. The optionalitity depends on the merchants previous risk levels, the transaciton type etc. it also dependso n the issuer settings. – Jmons Jul 14 '20 at 13:48
  • 1
    "a scammer would need your CC details for the CVV to be of any use" It's unlikely, but a scammer may have also been a hacker/worked with a hacker to get credit card numbers, names, and dates without CVVs, along with associated emails for purchases, and is sending out fraudulent emails to gain that last piece of information to make the credit card dump significantly more valuable. – TylerH Jul 14 '20 at 16:01
  • @nobody Exactly. Also, the CVV is the hardest one to remember. My card number hasn't changed in a decade and the expiration date is always the same month in three-year increments. Compared to that, I get a new random CVV every time one of my cards gets renewed, so it's pretty hard to keep track of what the current one is. – TooTea Jul 14 '20 at 16:39
  • 1
    @nobody Google Pay accepts my CVV just fine. My CVV is also present in my password vault. What is this you say about the browser not being allowed to store the CVV? – Nzall Jul 14 '20 at 19:45
  • "If they're new to accepting credit card payments, it's possible that they're still figuring everything out and it's an honest mistake." Most sites have a test version of their site to make sure most things work as expected. Missing the CVV would be a big oversight. – CJ Dennis Jul 15 '20 at 05:00
  • 1
    This could be a phish with an inside accomplice (or compromise)--they have the credit card data but not the CCV so it's not of much use to them. – Loren Pechtel Jul 15 '20 at 05:05
  • 1
    @user17915 No it isn't. A genuine one would never say "Your password has been compromised." – Asteroids With Wings Jul 15 '20 at 16:39
  • 1
    @Nzall Nobody did not say the browser cannot store CVV. The CVV cannot be stored by the merchant due to PCI DSS. You are perfectly free to do with your CVV what you want, store it in your browser, put it on a post-it on your screen, hire a skywriter... Further reading: https://blog.pcisecuritystandards.org/faq-can-cvc-be-stored-for-card-on-file-or-recurring-transactions – Adam Barnes Jul 15 '20 at 17:11
  • 1
    I believe that modern payment processors accept the card data including CVV one time, then return a token to the merchant that can be used for future sales by that merchant to the same customer. The token cannot be used for a purchase from any other merchant. – kevin cline Jul 16 '20 at 07:19
32

It may not indicate fraud but it suggests incompetence/amateurism on the part of the business. This is not the normal flow for accepting credit card payments -- have they just started doing so?

Ben Miller says:

They could just as easily have been mishandling the code if they had asked for it at checkout.

But asking for it at checkout is likely part of a standard software process. Asking for it in an email suggests an unusual, manual, "roll-your-own" process that is likely less secure than a standard one. Even if you won't be liable for any fraud, it's a sign that the business may also be amateurish in other ways (quality, customer service).

nanoman
  • 29,638
  • 3
  • 69
  • 89
  • With all the big name stores that were hacked and card numbers stolen in recent years, I don’t know that we can generalize that fancier websites and standard processes are any more secure than a mom-and-pop doing things manually. In any case, that’s what $0 fraud liability is for. – Ben Miller Jul 13 '20 at 18:40
  • 1
    Most small online merchants are not authorized to process sensitive card data at all - in their normal payment authorisation flow they would redirect to some merchant gateway which would get the card number and CVV without the merchant being able to see the data. I also believe that PCI DSS does not allow a manual authorization process that involves sensitive data being transmitted and stored insecurely (i.e. over email) - phone authorisations work, but this does not seem something like a legitimate merchant would be allowed to do by their merchant bank/gateway agreement. – Peteris Jul 14 '20 at 08:50
  • 11
    Yup, just checked - PCI DSS explicitly prohibits an "unusual, manual, "roll-your-own" process" that involves exchanging card data over email. In the standard, "4.2 Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, SMS, chat, etc.)". For "Sensitive authorisation data" such as CVV, it's even stricter than card numbers - you can't store them at all after authorisation, accepting CVV over email would need to ensure (and verify in audit) that the number is scrubbed from any and all email servers, logs and backups, which is nearly impossible. – Peteris Jul 14 '20 at 09:00
20

Even if this is an innocent request it's wrong.

PCI-DSS regulations (which have a global reach) are extremely strict about the management of card data. Certain values cannot be retained at all and some must be encrypted both in transit and at rest. The CVV is one of the more protected fields, so the fact that they're asking you to send it by e-mail is already a breach.

At the very least, they don't know what they're doing. This could be captured by a secure web form (most small companies just get an acquiring service to host the page for them), but e-mail capture is definitely not on.

David Fulton
  • 301
  • 1
  • 3
  • 17
    Agree. Never put anything in an email that you wouldn't write on a postcard. – Maaark Jul 14 '20 at 12:47
  • @Maaark - nice analogy. – David Fulton Jul 14 '20 at 13:09
  • I would think a legitimate but improper request to send confidential information over email should be met with an offer to telephone the company with the proper information if they email back information about how to reach the proper person through the company's main number. Though I knew someone who took that route and then got co-copied on an email where the person he phoned sent the confidential information to the person at the company processing the payment. Grrrr.... – supercat Jul 14 '20 at 15:14
  • @Maaark: while a good analogy, I'm not sure it's effective enough in this case. For you or I it goes without saying not to write your CVV on a postcard, but I'm pretty sure there are a lot of people out there who could be persuaded to send their CVV on a postcard, to a company that already had their card number and other details, reasoning that someone seeing the CVV alone isn't dangerous. "Don't give out your CVV except when placing an order by telephone or via a secure web form" is more like it! – Steve Jessop Jul 15 '20 at 17:22
  • @Maaark: to be more precise, 6 of those people are Ben Miller and the 5 upvoters of that answer at time of writing! – Steve Jessop Jul 15 '20 at 17:29
7

In my opinion, this really depends on the website. If the website is not really a storefront, but is - for example - a local (local to somewhere, anyway) gaming store that sells Magic/Pokémon cards online, something like that, where they take your information through the website but actually enter it in to their POS system by hand, then this is an entirely reasonable thing. This isn't a great way to do things - no part of a system where they enter information into POS that they collected another way is, and it's almost certainly not compliant with how they ought to be doing things - but it's not surprising, either, and probably not fraudulent in that case; they simply forgot to require the code during the checkout process.

However, if the website seemed to be complete with payment information built in, then I would be more wary. That makes it sound a lot more like phishing, to me.

All things considered, though, this seems somewhat low likelihood to be phishing, and high likelihood to be a store that's ... not highly secure. I would not email them back, but instead call them. If they're like I describe and doing things manually in their POS system - then it's possible you can handle this over the phone. Avoiding the CVV code being in email is one major benefit, and secondly you confirm that the email really did come from them by contacting them via a different method (and look up their phone # online, don't use the email you were sent.)

Joe
  • 35,786
  • 6
  • 90
  • 128
  • Who cares if it's phishin? It's shady! – jpaugh Jul 14 '20 at 22:41
  • 1
    You're not allowed to save the CVV code, so the part of your premise where they forgot to require it is invalid/at least as big a problem as the request in email. – Dan Is Fiddling By Firelight Jul 15 '20 at 20:11
  • 1
    @DanIsFiddlingByFirelight My suggestion here is that they're a small operation that doesn't follow these protocols correctly, yes. Just trying to differentiate between "not paying attention to the rules" and "scamming"; I think the former is more likely than the latter. – Joe Jul 15 '20 at 20:59
4

Adding to @davidfulton's answer...

The CVV is a "proof of possession" indicator. If you know the CVV, then it means the card is in your hand and you are reading it off the card. It should never be permanently recorded anywhere. When I'm talking to a customer service agent and they ask for the CVV, my response is "are you writing it down or are you inputting it into a computer?" If it's the former, I don't give it to them.

A properly constructed credit card processing system will handle the CVV properly (and these systems get audited all the time). Writing it down on a piece of paper or putting it in an email is just wrong.

Anyone who knows your CVV and your card number can prove that he/she "possesses" your card.

And yes, PCI-DSS is very fussy about what a merchant can do with card information and CVV information in particular. They should never be asking you to put it in an email.

Flydog57
  • 219
  • 1
  • 5
  • 4
    To clarify: PCI-DSS governs the merchant's procedures, not the customer's. A merchant who routinely asks for the CVV by email runs a serious risk of losing the privilege of accepting credit cards. Banks and credit card processors get all up in the merchant's face if they mishandle this information. – O. Jones Jul 14 '20 at 18:38
  • 1
    @O.Jones: Thanks. I made that clearer. We just finished all the cleanup from our PCI audit – Flydog57 Jul 14 '20 at 19:22
2

As a web developer I know that a store's web site should never store your credit card number. It should be passed to the payment gateway directly and never be stored. If the store still has your credit card number 2 days later to use with the CVV they are mishandling your payment information. Otherwise it is a scam. Don't send your CVV, contact the store to see what is going on (they may have been compromised).

John
  • 121
  • 1
1

CVV is never disclosed unencrypted, i.e. via email. It can only ever be disclosed through a secure credit card processing page. Its probably illegal for the company to request a CVV via email.

Flux
  • 17,043
  • 8
  • 68
  • 124
bandybabboon
  • 171
  • 7
  • It's not illegal, but it is a gross violation of the merchant's agreement with his credit card processor - CVV must be strickly handle using PCI-DSS rules (and this is just wrong). – Flydog57 Jul 16 '20 at 23:03
0

Let me ask you these questions:

  • Do you trust this website/business?
  • If they had asked for the CVV code at checkout, would you have provided it?
  • Do you believe that the email message you received is really from the company?

If you can answer yes to all these questions, then go ahead and give them the code. If you do not give them the code, your order will be cancelled and you will not be receiving your item.

I expect someone to comment at this point and suggest that what they are doing is illegal/improper, and that they shouldn’t need the code. I would say to them (and to you) that this company would not be asking for the code if they didn’t need it to process your order. If you would have provided it at checkout if asked, then you should provide it now.

They will also suggest that the company is mishandling the code. They may or may not be, but that is not really a concern of yours. They could just as easily have been mishandling the code if they had asked for it at checkout.

If it turns out that someone at this company is a crook, or if they get hacked and your card number & code get stolen, you will not be liable for the fraudulent charges. So while it is good to be cautious, if you have no reason to suspect the company/website is fake, I would say go ahead and give them the code.

Ben Miller
  • 115,533
  • 30
  • 329
  • 423
  • 9
    One reason to provide it at checkout but not over e-mail is that e-mail is not secure. In a normal flow, the data should have been sent over an encrypted connection, and should be scrubbed after authorization. This is difficult to guarantee with e-mail as copies may exist on e-mail servers, in recycling bin, etc. I don't believe it's illegal but it's not PCI DSS compliant. That doesn't mean they are crooks, they are probably honest but have slightly dodgy processes. Personally if I trust the business I'd be ok sending just CVV over e-mail, but not CVV + credit card details in the same e-mail. – JBGreen Jul 13 '20 at 21:23
  • 3
    @JBChouinard Yes, e-mail is not secure, but the message is not asking for the CVV and credit card number via e-mail, just the CVV, which is a useless three digit number without the credit card number (which they already have). Remember that the CVV is not a PIN, and you hand your card with both pieces of information to strangers all the time. – Ben Miller Jul 13 '20 at 21:37
  • I understand they're asking CVV only, I just wanted to clarify that "it might be ok to send CVV only over e-mail" does NOT mean "it's ok to send any and all credit card info over e-mail". – JBGreen Jul 13 '20 at 21:50
  • @JBChouinard Agreed. :) – Ben Miller Jul 13 '20 at 21:51
  • @BenMiller-RememberMonica I guess you mean "you hand over your card to strangers all the time" in the USA. In the UK, I can't remember the last time I did that - probably about 20 years ago (and I use card payments for almost everything).I would hope that if you enter the CVV into a reputable payment transaction via a web site, no humans get to know the CVV - it is just sent to the card company, checked, and then discarded for ever. – alephzero Jul 14 '20 at 03:10
  • 6
    Do you believe that the email message you received is really from the company? I've been doing IT professionally for 20 years, and my first job was babysitting mail servers. I wouldn't trust myself to accurately judge whether the message really came from the company and would presume it was phishing. (I'd call the company to either confirm and educate or disconfirm and warn them they had a breach.) – chrylis -cautiouslyoptimistic- Jul 14 '20 at 03:23
  • 2
    @JBChouinard CVV has stricter limitations than card numbers, there are many kinds of processing that are permitted for card numbers but prohibited for CVVs. Quoting PCI DSS, "Sensitive authentication data must not be stored after authorization, even if encrypted. This applies even where there is no PAN in the environment. " (sensitive authentication data includes CVV; PAN is the card number) - so it explicitly includes the scenario of CVV being sent separately. PCI DSS 3.2 requires you to ensure that the email with that number is unrecoverably (!) erased from all systems after authorisation. – Peteris Jul 14 '20 at 09:08
  • There's a lot of trust and belief required in this answer, not a good plan when information like this is concerned! – deep64blue Jul 14 '20 at 09:46
  • First you suggest that you should only go through with it if you trust the company, then you suggest that it doesn't matter because you won't be on the hook anyway? I'm not sure what you're actually suggesting here. – Fax Jul 14 '20 at 11:30
  • @Fax When transacting with anyone, you need to make a judgement whether the person/entity you are dealing with is trustworthy or not. In this case, the OP has already decided that this website is trustworthy enough for her to place an order. Next, you need to consider the risk to yourself in case you are wrong. In this case, because a charge card is involved, the risk is minimal, because of fraud protection policies. Most people make these judgements on a daily basis. – Ben Miller Jul 14 '20 at 11:36
  • 2
    @Peteris Like I said, I'm aware it's not PCI DSS compliant. If it was a payment system I was responsible for, it would bother me quite a bit. As a customer? Meh. With zero liability fraud protection, either the merchant or the bank is liable. Having my CC info stolen is an inconvenience so I'm not gonna give out to possibly malicious actors, but it's not my job to do PCI DSS audits of every merchant I interact with. – JBGreen Jul 14 '20 at 15:03
  • 2
    @Peteris My reasoning for why I wouldn't lose sleep over sending CVV over e-mail is that it's only 3 digits. There's only 1000 possibilities. By the pigeonhole principle, lots of credit cards share CVVs. Having a CVV alone doesn't get you far, if you don't know which CC it belongs to. Beyond that, if the merchant stores it improperly, they might be liable if fraud occurs, but that's mostly a problem between the merchant and the bank. – JBGreen Jul 14 '20 at 15:16
  • 2
    @JBChouinard my reasoning about this is that since legitimate merchants are prohibited to do this, then this is an indicator that this is possibly not an email from the merchant themselves, but a spoofed email from some third party scammer. For example, it might be that someone has hacked some merchant's database obtained CC numbers, emails and purchase info - but no CVV. CC number alone is not that valuable, so if they spam requests for CVV and some of the customers respond, then they can extract much more money from that breach since they can add the CVV to the stolen card numbers. – Peteris Jul 14 '20 at 19:22
  • 1
    So much bad advice in this answer, I hardly know where to begin.

    this company would not be asking for the code if they didn’t need it - email can be spoofed. Easily. It's not necessarily coming from the company. Surely you're aware of spoofed emails purporting to be from $bank? you will not be liable for the fraudulent charges - sure... but in the mean time there's additional balance on your card, you have the headache of getting charges reversed, may need a new card (and need to update the number stored in auto-update and with auto payments), etc etc etc.

     – Mark Jul 14 '20 at 20:51
  • @Mark Of course, e-mail can be spoofed. That’s why I started the answer the way I did (see third bullet). However, OP did say that the company has not yet charged the credit card for the sale, which does suggest that there is a delay. – Ben Miller Jul 14 '20 at 20:55
  • 2
    Of course, e-mail can be spoofed. That’s why I started the answer the way I did (see third bullet) ... which implies that your average person can determine whether an email is spoofed. Note the comment from @chrylis-cautiouslyoptimistic- saying that even a highly experienced admin can't always tell. – Mark Jul 14 '20 at 20:58
  • @Polygorial 152 – Ben Miller Jul 16 '20 at 15:22