Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

3
  • Hmm, I don't get it. In this case I'm the merchant as well. I'm just testing few things before launching the e-shop. I do require the CVV on the page because that's how the payment gateway recommended it. Can this be considered a vulnerability? Commented Dec 13, 2016 at 15:01
  • You should work with your processor / payment gateway, as it seems that you're not actually validating that CVV. Ask them why, find out your options for correcting it. The world's oldest vulnerability is being exhibited here - the system behaving as implemented, and not as you thought it was implemented :). Commented Dec 13, 2016 at 15:18
  • Based on the update, it sounds like the bank is the one failing to validate the CVV. I'd probably email the bank to let them know—they probably have a security email published somewhere. They'll either fix the issue or ignore it, but you'll have notified them about it. Commented Dec 13, 2016 at 20:57