Ask HN: Security of new credit card with {card, exp. date, CVV} on the same side | Hacker News Reader

Ask HN: Security of new credit card with {card, exp. date, CVV} on the same side

8 pointsbutterscotchwax6 comments

The fresh-new personal credit card I received (Canadian VISA) has card number and expiration date at the back of the card, neatly next to the three-digit CVV security number oÔ.

Wasn't the separation of { number, expiration date } and { security CVV } on both sides a security feature? Why is VISA undoing this / what's the security rationale?

A. Is the CVV security number useless anyway nowadays?

B. Has taking pictures of both sides become easy to the average optical attacker, making CVVs moot?

C. Is it an economical calculation that CVV-on-back-of-card costs N seconds of CVV spelunking during the average purchase, thus costing $$$/year in abandoned-midway purchases?

D. Has fraud reached a low enough point where it simply no longer matters to shave some of it with defensive measures?

E. Variant: has fraud reached a low enough point where the cost of the mechanical process of back-of-card CVV printing exceeds the cost of fraud?

F. Does this policy vary by region? (e.g. is VISA doing this in disciplined Canada, but never will in the <whatever_country_with_more_fraud>)?

G. ???

I'd mostly bet on C; what do you think? Also, should I worry and complain, or is attempting to talk to a bank beating a dead horse?

I think the placement of the number on the front is leftover from recording mechanisms.

You may remember (or maybe you don’t) that cards were embossed to enable carbon copy replicas, the method of generating receipts. Following that, the magnetic strip was added to allow an additional recording method. Similarly, the chip introduction has replaced the magnetic strip. With the strip and the chip, having the name and number on the front isn’t necessary any longer.

I suspect the threat of loss from shoulder-surfed cards is much lower than digital fraud, and this isn’t considered significant enough to make a difference.

I’d go so far as to say having all numbers on the back of the card will actually lessen the chance of shoulder surfing while the card is left inserted in the chip reader.

The merchant is pretty much always liable for fraudulent card-not-present transactions, so bulletproof security in this case is not necessary if you can just dispute any fraudulent transactions and get them reversed.

Aren't all cards chipped these days?

And couldn't you see all that data on the back of the card anyway? The number and the name is embossed.

Interestingly, I don't have a single embossed card anymore. Even my metal ones just have the stuff printed on the back.

I just had to rotate numbers and get issued a new card recently after my normal replacement one didn't show up in the mail. The teller at my bank said they had dropped embossed cards because no one took rubs of cards (besides people stealing them) these days and that was the reasoning behind having embossed cards in the first place.

Reply on news.ycombinator.com