We've encountered this before at work. It wasn't an issue when we rolled our own credit card processing. But when we switched to a popular payment service, we found out that "000" isn't a valid security code. There was no way to get around it. They made the customer get a new card from the bank. It was a very fun conversation to have.