The numbers on the back of the card, or CVV2

[Brother]

We all paid for something over the Internet at least once. And in most cases, when indicating the card details, we entered three numbers on the back of the card. Generally speaking, there are not three, but more As in the picture, for example. There you see seven numbers. It's just that the first four digits repeat the last four digits of the card number (PAN). Yes, it's simple. This is for ease of input and validation.

And the last three digits (circled in red in the picture) are just the CVV2 / CVC2 value. Translated as Card Verification Value 2 or Card Verification Code 2. The first name is used in MPS VISA, the second name is used in MasterCard. And they are calculated equally absolutely, the algorithm is the same, for some reason they called it differently. So everyone writes through a fraction.

About CVV I already I told you a little, now I will remind you once again what it is. By the way, I'm thinking of making a post in which the 3DES encryption algorithm, which is used in the calculation of CVV, PVV, as well as in many other places in processing. And not only. This work is quite voluminous, but has no practical value. However, like many other things in this life ... Therefore, I ask you to support me in this intention. If there is a noticeable number of likes for this post and other serotonin-stimulating events (like an increase in subscribers), then my determination to make this material will increase so much that I will get out the old blanks and really start

So, CVV. Card Verification Value (Card Verification Code). More precisely, CVV2 / CVC2. Number 2 indicates that there is also "number one" somewhere. And this is really so, on the magnetic track of the card, as well as on the chip of the microprocessor card, there is a CVV value, without a number. It acts as a digital signature of several values associated with the card. Namely:

- PAN (card number)

- Expiration Date (card expiration date)

- Service Code, consisting of three digits indicating:

• Card type and applicability (chip / magnetic, international transactions allowed)
• Do I need to process transactions in on-line mode
• Restrictions on the card: do you need a PIN, can you withdraw money or only pay at POS terminals, etc.

All these values (PAN, ExpDate and Service Code) are mixed in a certain way and encrypted with a special secret key of the bank. It turns out a long string in hexadecimal form. The first three digits are written out from it (and there may also be letters, from A to F, because this is a hexadecimal number). These three numbers are CVV (CVC). They are recorded on magnetic stripe or Track 2 Equivalent Data tag in the card chip. These data are used to check the card data when carrying out a card transaction.

And CVV2 / CVC2 are used in a situation where the card is not present. Card Not Present. Strange, isn't it? No, it's simple. You are sitting at a computer and want to pay for something. You cannot insert a card into a computer (and if there is a card reader, then there is no corresponding software and an agreement with the acquiring bank), therefore card data is entered by hand, and not read from the card itself. This is what is meant when it is said that the card is not present. And by the way, yes, you may have this data on a piece of paper next to it, the card itself is not necessary. Therefore, by the way, there is such a thing as a virtual card. Most banks offer this service. It is needed because it is easy to control: it is easy to close or restrict, without restricting the usual card. The virtual card exists only in the bank's database and in your notebook (file).

This data (CVV2 / CVC2) is not written to the magnetic stripe (and to the chip).

And CVV2 / CVC2 is calculated in the same way as CVV / CVC, but there are two differences. First, the service code is set to "000". This is a meaningless figure from T.Zr. specifications. Specifically, so that no one can use this value to write to the magnetic stripe of a counterfeit card. Well, encryption is performed with another key, specially designed for CVV2 / CVC2.

The card issuer (issuing bank) can check the correctness of the entry in the same way as with CVV / CVC - he repeats the calculations using the key, which is kept secret. And if you get the same result, the data is valid.

But stealing this value is not difficult ... Three numbers are easy to see and remember. Therefore, additional technologies are now being used to ensure the security of Internet payments. I plan to write about this soon.