CVV shops: How hackers get the three numbers from the back of your credit card

[steve2470]

http://www.theage.com.au/technology/consumer-security/cvv-shops-how-hackers-get-the-three-numbers-from-the-back-of-your-credit-card-20160426-gofqch

A longtime reader recently asked: How do online fraudsters get the 3-digit card verification value (CVV or CVV2) code printed on the back of customer cards if merchants are forbidden from storing this information? The short answer: if not via phishing, probably by installing a web-based keylogger at an online merchant so that all data that customers submit to the site is copied and sent to the attacker's server.

Kenneth Labelle, a regional director at insurer Burns-Wilcox.com, wrote:

"So, I am trying to figure out how card not present transactions are possible after a breach due to the CVV. If the card information was stolen via the point-of-sale system then the hacker should not have access to the CVV because its not on [the card data]. So how in the world are they committing card not present fraud when they don't have the CVV number? I don't understand how that is possible with the CVV code being used in online transactions."

First off, "dumps" — or credit and debit card accounts that are stolen from hacked point of sale systems via skimmers or malware on cash register systems — retail for about $US20 ($25.80) apiece on average in the cybercrime underground. Each dump can be used to fabricate a new physical clone of the original card, and thieves typically use these counterfeits to buy goods from big box retailers that they can easily resell, or to extract cash at ATMs.

[CaliforniaPeggy]

1. What if your card has a chip?

Does that help at all?

[Mosby]

2. probably only store transactions

[CaliforniaPeggy]

3. Well, that's good, since that's what I use it mostly for.