I once had a card with 000 CVC. This actually caused me more problems with form validation because 000 can be falsy depending on validation implementation. Sometime I would get a "you must put something in this field" depending on the site.