📸 Photo

SCRIPT'S TWENTY-DOLLAR DUMPS

from the trash by Dumpster-diving for receipts or the carbon-paper slips left over from retailers' sliding imprint machines. Now mechanical imprinting was dead, and Visa and MasterCard insisted that receipts not include full credit card account numbers. Even if you got the numbers, that was no longer enough to make counterfeit cards. The credit card companies now added a special code to every magnetic stripe—like a PIN, but unknown even to the cardholder.

Called a Card Verification Value, or CVV, the code is a number distilled from other data on the stripe—primarily the account number and expiration date—and then encrypted with a secret key known only to the issuing bank. When the magstripe is swiped at the point-of-sale terminal the CVV is sent along with the account number and other data to the issuing bank for verification; if it doesn't match, the transaction is declined.

When it was introduced by Visa in 1992, the CVV began driving down fraud costs immediately, from nearly .18 percent of Visa transactions that year to around .15 percent a year later. In the 2000s, the innovation proved a strong bulwark against phishing attacks, in which a spammer spews thousands of falsified e-mails aimed at luring consumers into entering their credit card numbers into a fake bank website. Without the CVV on the magnetic stripe—which consumers didn't know, and thus couldn't reveal—those stolen numbers were useless at real-world cash registers. Nobody could walk into a Vegas casino, slap down a card derived from a phishing attack, and get a pile of black chips to carry to the roulette table.

MasterCard followed Visa's lead with its own Card Security Code, or CSC. Then in 1998, Visa introduced the CVV2, a different secret code printed on the backs of cards for consumers to use exclusively over the phone or the Web. That further reduced crime losses and completed the Chinese wall between fraud on the Internet and in real life: Accounts stolen from e-commerce sites or in phishing attacks could only be used online or over the phone, while magstripe data could be used in-store but not on the Web, because it didn't include the printed CVV2.