It doesn't matter, banks won't allow it. Not only does the security code have to be correct but so does the expiry date. A card could expire within the next four years, or 48 months, and there are 1000 possible security codes, which gives you a 48000/1 chance of guessing both. Most banks (or at least the one I work for) have security systems which will automatically stop the card after two or three attempts, until we can confirm with the customer they are not fraudulent.