I think your experience is correct as far as it goes, but many people who've dealt with PCI-DSS have only done so in the context of companies where the delay be

I think your experience is correct as far as it goes, but many people who've dealt with PCI-DSS have only done so in the context of companies where the delay between pre-authorization and post-authorization is seconds, e.g. some online merchant where you immediately charge the card. During this period you can store the CVC, and in some industries, such as accommodation, that time can be weeks/months. E.g. standard practice in some hotels is to store this information at check-in and charge on check-out. This blog two-part blog series is enlightening: https://pciguru.wordpress.com/2018/01/27/pre-authorization-and-post-authorization-part-1/ https://pciguru.wordpress.com/2018/01/27/pre-authorization-a... https://pciguru.wordpress.com/2018/02/17/pre-authorization-and-post-authorization-part-2/ https://pciguru.wordpress.com/2018/02/17/pre-authorization-a... And here's Booking.com's official documentation for partners showing that they can access the guest's CVC code (once): https://partnerhelp.booking.com/hc/en-gb/articles/360000764307 https://partnerhelp.booking.com/hc/en-gb/articles/3600007643...