How does the security code check work?
The customer types the three or four digits from the card, and the provider sends them with the authorization request. The issuer compares them with the value it holds and returns a match or mismatch with its decision. Stripe’s documentation describes the code as a number printed on the card that only cardholders in physical possession of the card should have access to, checked by the issuer during authorization.
Why does it matter?
Because merchants may not store the code, it is rarely exposed in data breaches, which makes it an effective check against stolen card numbers. As an illustrative example: a store sees a burst of 500 payments with valid card numbers but wrong security codes in one evening. Blocking mismatches stops nearly all of them at the cost of a few customers who mistyped, who can simply try again.
What are the limits?
The check proves knowledge of the code, not identity. Stripe points out that it does not protect against physical theft of a card or against compromised devices and poorly secured websites where the code is captured as it is typed. Phishing and malicious scripts on checkout pages can steal the code with the rest of the card, which is why PCI DSS also covers how payment pages are protected.
Where does Omno use it?
Customers enter card details, including the security code, in Omno’s hosted checkout or in Card Fields on the merchant’s own checkout, so card data is handled in Omno’s PCI DSS compliant environment rather than on the merchant’s servers. Saved cards are stored as tokens for repeat payments, and issuers can still request 3-D Secure in the same flow.