Hacker News Reader

Comment by tehwebguy | Hacker News Reader

From Target's notification email:

> Is the CVV code the same as the three digit code on the back of my card? > No, the CVV code is not the same as the security code on the back of your card. As of now we have no indication that the three digit code on the back of the card has been impacted.

I am under the impression that:

1. CVV is exactly the same as the security code

2. Merchants are never allowed to store this code

View on HN

There are two CVV codes, CVV1 and CVV2. CVV1 is on the magstripe but not printed on the card. CVV2 is printed on the card but not on the magstripe (it's the three digit code printed on the back).

It sounds like Target was storing the CVV1 code (which they shouldn't have been), but there's no way they could have the CVV2 code, since the POS computer never sees it.

This means that the stolen data could be used to make a cloned card for physical purchases, but couldn't be used for an online purchase (unless the online store doesn't ask for the CVV2).

See http://en.wikipedia.org/wiki/Card_Verification_Value

If the POS terminals were compromised, attackers could have retrieved CCV1 numbers at the point of reading the card. In other words, it's still possible Target complied with the PCI requirement of not storing CCV numbers. But since nobody knows how the attack happened, it's all just speculation.

At target, you insert your card into a device that fully captures it. It's quite possible they could photograph both sides/OCR to find your CVV2.

(AFAIK they don't, but there certainly isn't "no way" they could have it.)

Not at all Targets.

I worked at several stores (up through 2008), and still shop there.

I have never seen a credit card machine at the stores I have been in contacted that fully captures a credit/debit card.

Reply on news.ycombinator.com