Indeed, you don't need to do it ever. I don't take CVV codes, nor does 37 Signals.