Hacker News Reader

Comment by mjs | Hacker News Reader

I don't understand why, instead of adding extra fields to collect more information, the banks and credit card companies instead just added more digits to the original fields. So instead of a separate field for the security code, why not just append the security code (and the postcode, and the XXX, etc.) to the credit card number field? I always have to enter a bunch of information anyway, so why not let me enter it all in one go? (Better for copy and paste.)

The way they're doing things at the moment is driving people to pay via PayPal, because PayPal requires--hey look!--a single string which they call a "password".

View on HN

What makes the security code (CVV) different from just having more digits is that you (the site/merchant) not allowed to store it permanently in your database. You can keep it in-memory for up to 15 minutes while authorizing the transaction.

That means in theory, if the merchant's credit card database gets hacked, the fraudsters will get access to the credit card numbers but not the CVV.

In practice, the rules aren't obeyed as strictly as they might, so you can easily find credit cards with CVV on the black market.

Even if the different fields have different security requirements, that doesn't seem to be a good reason to require them to be entered separately.

I don't really care if someone mandates that digits 1-4 can be sent via email, digits 5-10 can be stored unencrypted, digits 11-16 must be encrypted, and digits 17-20 can never be stored at all. They're still just digits/bits of information, and I have to provide all of them almost all the time anyway.

The one exception is when a retailer has saved my credit card number, in which case they might ask me for the CVV only. But I'd rather that they didn't save the card number at all! I have to look up the CVV and copy and paste it into their form every time anyway--so they may as well require the whole thing every time.

Compatibility is a valid reason. You really can't change any parts of a system with so many participants in every country worldwide - you can only add new layers to it.

For those who are interested, this is what I am told is one of the original reasons for inventing the CVV value. Back in the olden days credit card transactions were processed and verified by taking an impression of the card and the raised numbers on the front of the card. To prevent merchants, and/or employees of those merchants from taking credit card numbers off of the impressions and using them to make over the phone transactions (or any transaction where the card is not physically present), the CVV value was created. This is why the CVV value is printed on the back of the card, or if it's on the front of the card then it's not printed on raised type, so that the CVV number will never show up on credit card impressions. This is why the CVV number is often referred to as the "credit card not present" number, and is usually required when making transactions where the card is not physically present to the merchant.

Because way back in the old days they used it have these machines that would run over the card and clone the card information onto carbon paper.

That's why the number is raised on the card.

But those machines are for point of sale purchases only and should NOT get enough information for the card to be used over the phone/internet. Otherwise you'd have tons of carbon sheets that could be used to defraud people.

Also as the other poster said, harder to photograph using a card capture device attached to an ATM/cashpoint.

But you basically can't do anything with a credit card number anyway--there doesn't seem to be much point breaking a long number into 10+ shorter numbers with different security requirements if you need all of the numbers all the time to do anything anyway. It's not like I can make purchases under $5 with just a CC number, but for larger purchases I have to provide more information.

> why not just append the security code

It may be an extra layer of protection related to getting the credit card number via seeing or taking a picture of the front of the card, having it on the back helps improve security from that aspect.

Reply on news.ycombinator.com