Hacker News Reader

For the CVV you can't store it even if you have passed PCI compliance. You are only allowed to collect it for a specific transaction, and are required to forget it when that transaction is complete.

View on HN

That can't be right. I entered my credit card information once into uber eats and I can buy food whenever without entering a CCV and my credit card is immediately charged.

If this were true 1000s of large companies would not be PCI compliant.

Storing the CVV permanently is indeed strictly forbidden. The CVV is not used for purchases on a stored card.

It’s possible to process transactions without a CVV, but it often costs slightly more due to the increased fraud risk. In the case of Uber Eats, they’ve presumably decided the increase in purchases from removing that friction makes up for the higher fee.

Reply on news.ycombinator.com