MR A, young call centre executive had just obtained his first credit card, when another bank’s DSA (Direct Sales Agent) approached him and explained the benefits of carrying two cards. The new card was for ‘free’ and the only document required was a photocopy of the first credit card. Mr A felt proud for the power of his first card and in his enthusiasm to quickly get another one in his wallet, he photocopied both sides of his card and handed over to the DSA executive. At around same time, Mr B, who teaches history at the city college, was impressed by the tele brand advertisements on TV and recently obtained an ATM-cum-debit card to be used for mail and telephonic orders. A few successful transactions later, he found one of his orders was not getting accepted even after repeatedly punching of the numbers as guided by the voice prompt. After making few attempts, he nearly gave up, before he realised that it was the last day to avail of the ‘best offer’. He, therefore, decided to take the help of a tele agent and read out to her the card number, validity date and the last three digits on the signature panel of the card for urgent processing of his order.
Prima facie, both the above stories sound mundane, which none of our friends above found anything disturbing either. However, Mr A and B were all shocked to see what they found in account statements of their cards the following month. They found their card had been misused and found items of online shopping transactions, which they never did.
As on date, transactions in CNP (Card-Not-Present with the merchant) environment such as online ticket booking, utility bill payments, purchase of books or any Internet, telephone or mail orders, merely require the users to enter their card number, card validity month/year and a code called CVV (Credit Verification Value) or CVC (Card Validation Code) that is available on the card itself.
CVV is a three-digit code typically imprinted at the end of signature panel on the reverse of the card (or a four-digit code little above the end of card number on front side) and is meant to serve as authorising code for CNP transactions. In short, CVV number in CNP transactions is a key to your card account, just the way the ATM PIN is for accessing your bank account. However, unlike the PIN for ATM use, CVV code is printed on the card itself and is rarely protected by the users. This exposes all credit and debit card users to the risk of their cards being misused for online shopping.
Banks, when contacted, remind you of the standard terms and conditions for issue of cards and say you are advised to protect your cards all the time. You must ensure that your card is swiped strictly in your presence and no one is making a note of your CVV for fraudulent online usage. They further tell you, in case you suspect that your card details are exposed, you must get a fresh card issued with new CVV and then protect that card well. Under these circumstances, the only way to protect your debit or credit card from fraudulent CNP transactions is to memorise the CVV and then put a small opaque sticker on it or simply erase it from the card.