They're generated independently of the card number and, in principle, known only to the card issuer and verifiable only by asking them. Merchants are supposed n

They're generated independently of the card number and, in principle, known only to the card issuer and verifiable only by asking them. Merchants are supposed never to record them. (They don't really need to be independently generated for each card; instead they can be computed from the card number, expiry date, etc., using a secret key known only to the issuer and some cryptographic magic.)