Requiring a credit-card verification code (the three- or four-digit number found on the back of Visa, MasterCard and American Express cards) can reduce the number of fraudulent transactions. But many merchants do not ask for this code. Why?
Julie Fergerson, co-founder and vice president of Emerging Technologies at ClearCommerce and recently elected chair of the E-Commerce Fraud Protection Network, says the reason most merchants don't ask can be found in a recent study. This study, which was done by a group of merchants, found that abandonment rates increased when consumers were asked for the verification code. The merchant must make a decision -- risk sales or risk fraud. Damned if you do, damned if you don't.
Consumers also are at risk if merchants require the verification code. At a recent conference, Fergerson asked a group of merchants if they store the credit-card verification code along with other credit-card information when processing online transactions. About half of the merchants said they do. This is disconcerting from the consumer's standpoint. Storing this number is a huge mistake: If the data is exposed, both the credit-card number and the verification code can be used by thieves.
The credit-card verification code was designed to increase security, but merchants and consumers must agree to use it properly for it to help security.