British Airways Support Asks for Credit Card CVV as Support Verification Code

7 pointsbapcifail3 comments

Support agents usually ask for a security phrase or information about your address to verify your identity.

British Airways ask for your credit card CVV to verify your identity.

This means they must be storing it, which is prohibited under PCI.

https://security.stackexchange.com/a/73195

I think I had the case with jet2, where support for a change of a cancelled flight required my CVV, I called them and told them that I am not willing to provide that information and they should figure out something else. They instantly replied that I can input anything on that form and that it didn't matter and so was it.

Which this reply on that SE confirms https://security.stackexchange.com/a/210181

I don't think that this implies that they store CVV codes.

They have the card's details on file. They may simply use the CVV code provided by the customer during the call to run a check without storing anything.

Reply on news.ycombinator.com