I believe you ask for it the first time. Once its approved once you can assume they have the physical card. But yes, you are not supposed to store the CVV2. Vi

I believe you ask for it the first time. Once its approved once you can assume they have the physical card. But yes, you are not supposed to store the CVV2. Via http://en.wikipedia.org/wiki/Card_Security_Code#CVV2_limitations http://en.wikipedia.org/wiki/Card_Security_Code#CVV2_limitat...: Since the CVV2 may not be stored by the merchant for any length of time[2] (after the original transaction in which the CVV2 was quoted and then authorized and completed), a merchant who needs to regularly bill a card for a regular subscription would not be able to provide the code after the initial transaction.