British Airways Support Asks for Credit Card CVV as Support Verification Code

Posted by bapcifail on Tuesday June 29, 2021 @03:52AM
from the self-post dept.

Support agents usually ask for a security phrase or information about your address to verify your identity.

British Airways ask for your credit card CVV to verify your identity.

This means they must be storing it, which is prohibited under PCI.

https://security.stackexchange.com/a/73195

( 3 comments | 7 points | on HN )

Re:British Airways Support Asks for Credit Card CVV as Suppo... by Petrakis on Tuesday June 29, 2021 @08:14AM (#27674748)

I think I had the case with jet2, where support for a change of a cancelled flight required my CVV, I called them and told them that I am not willing to provide that information and they should figure out something else. They instantly replied that I can input anything on that form and that it didn't matter and so was it.

[ Parent | on HN ]

Re:British Airways Support Asks for Credit Card CVV as Suppo... by Petrakis on Tuesday June 29, 2021 @08:19AM (#27674781)

Which this reply on that SE confirms https://security.stackexchange.com/a/210181

[ Parent | on HN ]

Re:British Airways Support Asks for Credit Card CVV as Suppo... by mytailorisrich on Tuesday June 29, 2021 @04:03AM (#27673138)

I don't think that this implies that they store CVV codes.

They have the card's details on file. They may simply use the CVV code provided by the customer during the call to run a check without storing anything.

[ Parent | on HN ]