The CVC number is just one security measure in a credit card. One of the legitimacy signals, so to speak, and its absence is not an immediate fraud flag.

While a bad security practise, a transaction can still go through if the other verification signals like expiry, name, billing address, etc (most of which are accessible through social media, btw) provide sufficient confidence in the legitimacy of the transaction.