When taking donations or ticket orders on the phone or via snail mail...does your organization require a CVC code from the customer?
I know many organizations use them for online orders/donations but what about on mail-in forms or for phone calls?
Just want to know how these are being utilized by other similar arts organizations. If you have any reasons as to why your organization does it the way they do that'd be great info too.
Thank you!
CVV codes are intended to affirm that the card is present, and thus when they are communicated over the web or on the phone, they are not to be stored in any way after the transaction has been authorized.
I can't find anything definitive about mail order forms, but if you did collect this information on a mail form, it would need to be destroyed entirely after authorizing. My interpretation is that since there is significant lag time between when the card data is recorded on the order form by the customer and when it is submitted by the merchant for authorization, it is not appropriate to ask for a CVV/CVC.
Ultimately, you should be able to ask your merchant bank for their input on this question.
Good morning Shannon,
In our consortium, there are varying levels of policy with regard to requiring the CVV/CVC codes from a credit card; some organizations are pretty strict about wanting it, while others never require it for entry even if they do have the card on-hand.
One v15-related consideration is that CVV codes can no longer be entered on Controlled batches (because the CVV code was being temporarily stored and affecting the PCI compliance profile) so if you do use CVV codes and you're currently exclusively using Controlled batches, you'll want to start getting familiar with Uncontrolled batches and the inherent differences involved in processing.
Thank you,
Brian
In Canada Visa has mandated that we collect CVV2/CVC codes with phone and online orders (and specifically NOT on mail orders, and also not monthly/recurring payments) https://www.visa.ca/dam/VCOM/regional/na/canada/security/security-documents/expanded-cvv2-one-pager-en.pdf
You're not required to put in a CVV to process payments, but it sounds like you're on the hook if the payment is fraud and you didn't take the CVV. I can't find a clear do and don't list from Visa.
Thanks for the heads up about Controlled batches in v15! We're about to upgrade and I'll have to train everyone on that.