3 ms·
From the screenshot in that article, it looks like Target stored not just the credit card number, but also expiration date and full magnetic track information,
by guan 13y ago
From the screenshot in that article, it looks like Target stored not just the credit card number, but also expiration date and full magnetic track information, including CVV1.
Why in the world would they do that? I would lose a lot of sleep over if I had to store just name and card number, but at least I could see some use for that. For example, you could look up a customer’s past purchases for returns or warranty claims.
Why did Target want to store the expiration date, so the card could be used on online stores that don’t check CVV2, and the magnetic track info with CVV1 so the cards can be cloned?
- NoPiece 13y agoThat's a good question. If the thieves didn't have the CVV1, it should have been a lot harder for them use the stolen cards. I would have thought the "no store" rules should apply to both CVV1 and CVV2 to help ensure that presence of a legitimate card. -- Edit: if early reports are accurate, and the credit card data was stolen via malware on the POS machines as the cards were swiped, then it would make sense that they would capture every possible piece of data, including CVV1.
- elwell 13y agoYou don't need the CVV unless you're in the UK (or somewhere that requires it). I've made plenty of online cc forms for US based companies that did not have include it (that doesn't sound very good now that I write it out).
- guan 13y agoCVV1 is the code that is embedded in the magnetic track and allows you to swipe the card. CVV2 is printed on the back and used in many, but as you correctly point out not all, online stores.