> Of course I really hope the Marriott weren't storing CVV in a reversibly encrypted format. You're not allowed to store the CV2 in any form that could be reco

> Of course I really hope the Marriott weren't storing CVV in a reversibly encrypted format. You're not allowed to store the CV2 in any form that could be recovered (i.e. plain text or reversibly encrypted) or brute forced (i.e. hashed/salted). PCI rules say you simply aren't allowed to store the CV2 after the call for an authorisation, as it's no longer required. If they were storing the CV2 then they're in trouble.