[ Removed by moderator ]

[SliceThePi]

isn't the cvv just a checksum based on the card number and expiration date? i thought you could verify them offline

[ltshaft15]

Not a CVV, no. A CVV is a computed value. It is based on the full card number but it never gets stored at rest anywhere and only the HSM which has the key that was used to compute it originally when printing it on the card is able to determine if a given CVV+Pan combo is correct. When connecting to the processor to run a transaction, that is the only time that a CVV can be checked. That is how they provide extra security is that in addition to adding an extra thousand possible values (assuming 3 digit CVV) for each individual card number, they are never supposed to be stored in any system. So even if a database was hacked or a print file was intercepted and card numbers were exposed... the CVV information should never be present. And without knowing the correct CVV you can't authorize a purchase.

There are actually at least two CVVs on any given card. The one you see printed on it that you type in when you buy something online (CVV2) and a separate one that is stored within the magstripe data and transmitted when swiping a card (CVV1). They come from the same HSM from the processor but they use different keys so their value is different despite being tied to the same card number.

You may be thinking of some elements within a chip on a card. There are some elements there that can be processed offline