Argthtjtr

Ever since online commerce became a reality, it was sufficient to know the credit card number, expiration date and CVC code to purchase anything online. Things are slowly changing as MFA is getting adopted by more and more banks around the world, but this wasn't the case for the majority of online stores in the past 20 years. Even before online shopping was a reality, you could still purchase items by spelling out your card's details over the phone.

So why did banks and credit card companies decide to keep printing those supposedly secret codes directly on the card itself? This way anyone can just take a picture of the card or memorise the numbers and fraud the account owner. This is especially easy for someone like a waiter, as they often remove the card out of reach for a couple of minutes as you pay your bill.

Ultimately you don't bear the fraud risk so you you don't set the risk tolerance. The three digit code, the whole card number, chip and pin, chip and signature, the signature on a receipt, the info in the mag strip etc. Your bank will tell you that all of them are really secret and you should protect them but would tattoo them to your face if they could.

The name of the game is lowest possible transaction friction relative to acceptable fraud costs.

Why is the three digit number printed on the card? Because presumably you have the card in your hand when you want to use it. This 'secret' code came about to combat and/or pre-empt low level fraud primarily related to lazy mag-strip skimming and the old days when receipts were imprints of the card. This number is not part of the mag-strip data, and only meant to be a secret from the mag-strip and people who might find themselves in possession of a large number of imprint receipts (in the early days of credit cards) or a database filled with credit card numbers. It was only ever intended to offer low level proof of the presence of the card to combat instances where large amounts of account numbers were taken; it doesn't authenticate or secure transactions, it's not a checksum, it's just a number thats not in the mag-strip or imprint. Interestingly, though not surprisingly, the number is not simply random it's derived from the primary account number cryptographically in a manner known only to the card issuer.

Why doesn't the bank try harder to protect the number? Because the bank wants you to use the card without having to remember a number.

Why is American Express's four digit 'secret' number on the front of the card, not even securely hidden away on the back, who knows; but clearly the number is not intended to be secure to anyone who might have physical access to the card.

Why isn't the card naked but for branding with the information securely stored somewhere else? Because two places is more places and you might not use the card if you need to dig up the piece of paper that was mailed to you separately with the obviously never-intended-to-be-secure three digit code printed on it.

The bank's incentive is for you to use the card. If you don't use the card, or you use a competitor's card the bank makes no money.

If you would like to secure your payment methods better than the level the bank is comfortable with, you are free to do that. Scrape the numbers off, pull the mag strip off, whatever; though probably altering the card is a breach of your cardmember agreement. The bank doesn't do that because the bank doesn't care.

The purpose of the security code is not a secret PIN. The purpose is to "prove" that you have the physical card in your possession at the time of purchase. It is only used when the merchant cannot confirm that you have the physical card in your possession. It is used when purchasing something from a website, but it is also used at a physical store when the card cannot be scanned and the number has to be typed in manually.

The reason it is printed on the card is that someone other than you might need to read it. If you hand it to a cashier and they are unable to scan the card for some reason and must type in the number, they can flip over the card and type in the security code, proving to the computer that they have the card in their possession. It was never meant to be memorized, and if card users do memorize the code, it loses its effectiveness as a proof of physical card possession.

You can argue that having the code printed on the card makes the card less secure, and some have suggested scraping the code off the card after you memorize it, but that really only would prevent a specific type of credit card fraud that is not as common as other methods of fraud.

In the absence of a true PIN, it is becoming increasingly common to use the billing zip code as another validation, as it is a number that the card owner already has memorized and is not printed on the card.

The main purpose of the security code is to prevent hacked card information from being reused. The main way that this is accomplished is by requiring that payment processors do not store this code

Merchants, service providers, and other entities involved with
payment card processing must never store sensitive authentication data
after authorization. This includes the 3- or 4- digit security code
printed on the front or back of a card, the data stored on a card’s
magnetic stripe or chip (also called “Full Track Data”) – and personal
identification numbers (PIN) entered by the cardholder. This chapter
presents the objectives of PCI DSS and related 12 requirements.Source - slide 11

You are asking why the card number and the security code are printed on the card. In both cases, let's review a bit of history:

The card number

The card number (called PAN in the industry) is just an identifier, it has no reason to be secret. It is needed for any transaction, so that a charge can be... charged back to the relevant account, whether:

• at a physical point of sale (POS), using the old "imprinter" method (not sure if that's still in use anywhere). That's the reason the number is actually embossed, not just printed (along with the other details required for the transaction: expiry date, name of cardholder).

• at a point of sale, using a POS terminal ("credit card machine"), which either reads the magnetic stripe or the chip of the card, which both provide the PAN and the rest of the data without any authentification or encryption.




• by phone or paper (what is known as "MOTO" in the industry: mail order / telephone order), when you just read the details over the phone or write them on the order form.




• on the internet, where you need to read the number off your card and enter it into a form. How could you order anything if you can't read the card number?

The PAN has never been considered a secret. It's just an account number, exactly like your account number appears on paper cheques, to know what account the money should be taken from.

Some people think the key (the last digit) is a (poor) security feature, while it's actually only used to protect against input errors (digit changed, digits swapped...).

Nowadays, people start to think that a PAN should be secret, and this has led to the introduction of "tokenisation": instead of sending the actual card number, another card number is sent instead, which is either limited to a specific channel (and possibly device), or even to a single transaction.

This is the case for instance for Apple Pay: when you register your card with its real PAN, the bank sends back a token ("fake" PAN) which is used instead, and can only be used for payments made with Apple Pay on that device. If ever someone intercepted that PAN, they wouldn't be able to do anything with it: it won't be accepted to add a card to Apple Pay, won't be accepted in store, online, over the phone, or anywhere else.

Is that really useful? In a perfect world where all transactions are authenticated by other means, it really shouldn't matter, a PAN by itself should be useless. In practice, as there are channels that allow the use of pretty insecure authentication methods, that's an additional line of defence.

Note that the need for tokenisation is probably slightly more important with the introduction of contactless: you can read the PAN of any contactless card without even touching it, it's just a matter of getting close enough.

The security code

The security code printed on the back of the card (or on the front, for American Express cards) was not originally present. It was added to avoid the following fraud scenarios:

• a credit card receipt with the full card number (and name and expiry) was discarded and collected by someone else (this was especially true when imprinters were in use, but was also true before the card networks finally decided it was forbidden to print the full PAN on the customer receipt).




• a card is "swiped" to record the contents of the magnetic stripe, which contains the PAN, expiry, cardholder name, and more...). This allowed people who had physical access to cards (waiters, cashiers...) to record large numbers of cards pretty quickly without being noticed.

To counter this, this new code was added, which is not on the receipt (as it's not embossed), and is not on the magnetic track either.

This code is required only for MOTO and online purchases, where you cannot see if the user actually has the card (a so-called "card not present" transaction), and you want to be a bit more sure that the user has the card.

This is indeed quite easy to circumvent: you just need to either make a full copy of the card (both sides) or make a note of all the data. But in many of the scenarios above, that made it just a bit more difficult for a dishonest user to do it without being noticed.

(The introduction of hand-held terminals also helps a lot, as a user can keep his eyes -- and hands -- on the card at all times, but especially in restaurants in the US, this is not yet standard practice).

The security code also helps in the case a site stores your credit card data, and someone manages to get access to it: in theory, no-one is allowed to store the security code, so a hacker would only get the PAN and expiry, and would not be able to use it again, but, in practice, way too many people still store the security code. The industry is chasing after those (it's one of the aspects of the PCI DSS initiative), but there's still a long way to go.

The real protection comes from new authentication measures (3D Secure) that allow another mode of verification beyond just that data. Depending on the bank (or even the card), they could involve:

• a password


• a one-time password (OTP) sent via SMS or other means


• biometric authentication (fingerprint, face recognition, iris scan...)


• actually talking to the chip on the card by use of the card reader connected to your computer (I'm not sure this has actually been deployed anywhere)
  ...

Note that the security code is used only for online/MOTO transactions ("card not present" transactions). Card present transactions will either use:

• another security code which is on the magnetic stripe (though this is easy to copy)


• communication with the chip (on cards that have one) so that the card authenticates itself.