edit: CCV proves that you at one time had access to the CCV number.
Online merchants are supposed to comply with PCI-DSS - not store your CCV ever, never transmit your number unencrypted, never store cardholder information unencrypted, plus tons of management controls and audit controls over the same.
In practice, let's just say lazy programming is everywhere.
I've seen many people who handle online transactions and violate PCI-DSS to some degree, including storing CCV numbers.
Comments
CCV proves the cardholder was present at the time of the transaction. Online merchants are never allowed to store CCV numbers.
edit: CCV proves that you at one time had access to the CCV number.
Online merchants are supposed to comply with PCI-DSS - not store your CCV ever, never transmit your number unencrypted, never store cardholder information unencrypted, plus tons of management controls and audit controls over the same.
In practice, let's just say lazy programming is everywhere. I've seen many people who handle online transactions and violate PCI-DSS to some degree, including storing CCV numbers.
They can ask for them though.
.. indeed, and they often do.