The two codes are probably because the banks distinguish between merchants that take cards online and those that only accept physical cards; the latter get char

The two codes are probably because the banks distinguish between merchants that take cards online and those that only accept physical cards; the latter get charged less, because they're a lower risk. (At least, that used to be the case.) With two codes, the banks can require physical-only merchants to include the CVV2.