Why do some online stores not ask for the 3-digit code on the back of my credit card?
As a general premise: In most of the online transactions in case of dispute the benefit of doubt is given to the customer. IE if the customer refuses to pay and claims that its not his transaction, the card company reverses the charges and does not pay the merchant (or recovers if its already paid).   There are many types of online vendors who use a variety of methods to ensure that they are not at loss. Some of these are: Given that the laws on consumer liability for unauthorized transactions mean no cost in most cases, the CVV is there to protect the merchant.  Typically a merchant will receive a lower cost from their bank to process the transaction with the CVV code versus without. As far as the Netflix case goes, (or any other recurring billing for that matter) they wouldn't care as much about it because Visa/MC/Amex regulations prohibit storage of the CVV.  So if they collect it then it's only used for the first transaction and renewals just use the rest of the card info (name, expiration date, address). Does the presence of CVV indicate the merchant has better security?  Maybe, maybe not.  It probably means they care about their costs and want to pay the bank as little as possible to process the transaction. There are different ways of credit card purchase authorizations. if some choose less secure method it's their problem. Merchants are charged back if a stolen card is used. Some businesses verify the shipping address with the credit card company, and refuse to ship to an alternate address without additional, offline verification.  Of course, this is only useful for physical goods. @Jeremy Using CVV doesn't decrease the transaction cost. I know this because I have quotes for CC transactions and the cost/transaction doesn't depend on using CVV. That said we don't plan to use CVV because we sell insurance and the likelihood that someone who steals CC will buy insurance is very low. The truth is that Visa does not require a merchant to enter the cvv number before authorizing a transaction.  The only information that is really needed is the credit card number and expiration date.
In some case the customer wants the name to be cryptic or misleading. They don't want to advertise the true nature of the business they visited. In other cases the transaction may be reported through another business. A few years ago the local PTA was having a silent auction as a fundraiser. A local business allowed the PTA to use their credit card reader to process transactions over a certain amount. Of course when the credit card statement arrived it looked like you spent $500 at the florist. I have seen PayPal listed when donating to some small charities.  I have noted another case where confusion can occur. I used a debit card to buy a soda from a vending machine: the name and location were the name of the vending machine company and the location of their main office. It didn't say  soda machine city A. It said Joe's vending company city B. In most cases the business and the credit card company want to make it easy to identify the transactions to keep the cost of research and charge backs to a minimum. The reason is in your own question. The answer is simple. They use that code to tax the product otherwise it would just be out of pocket expenses. Chip and Pin cards are popular in Europe, however in the US we don't have them.  Visa/MC and Amex can issue chip and pin cards but no merchants or machines are set up here to take them.  Only certain countries in Europe use them and since you could possibly have a US visitor or a non-chip and pin person using your machine or eating at your restaurant they usually allow you to sign or just omit the pin if the card doesn't have a chip. It is definitely less secure, but the entire credit card industry in the US is running right now without it, so I don't think the major credit card companies care too much (they just pass the fraud on to the merchants anyway). Lol you moron. Chip and pin significantly reduced physical retailer fraud when we introduced it in Europe (a decade ago? 15 years?) - a signature is absurdly easy to fake and retailers have little to no way of protecting against it. "I'm not sure if this answer is going to win me many friends on reddit, but here goes...  There's no good reason why they couldn't have just told him the current balance shown on their records, BUT...  **There are some good reasons why they can't quote a definitive ""payoff"" balance to instantly settle the account:**  It's very possible to charge something today, and not have it show up on Chase's records until tomorrow, or Monday, or later. There are still places that process paper credit-card transactions, or that deal with 3rd-party payment processors who reconcile transactions M-F, 9-5ish, and so on.   - Most transactions these days are authorized the instant you swipe the card, and the merchant won't process until they get authorization back from the CC company. But sometimes those authorizations come from third-party processors who don't bill Chase until later. Some of them might not process a Friday afternoon transaction until close-of-business Monday.   - Also, there are things like taxicab fares that might be collected when you exit the cab, but the record exists only in the taxi's onboard machine until they plug it into something else at the end of the shift.   - There are still some situations (outdoor flea-markets, auctions, etc) where the merchant takes a paper imprint, and doesn't actually process the payment until they physically mail it in or whatever.   - Some small businesses have information-security routines in place where only one person is allowed to process credit-card payments, but where multiple customer service reps are allowed to accept the CC info, write it down on one piece of paper, then either physically hand the paper to the person with processing rights, or deposit the paper in a locked office or mail-slot for later processing. This is obviously not an instant-update system for Chase. (Believe it or not, this system is actually considered to be *more* secure than retaining computerized records unless the business has very rigorous end-to-end info security).   So... there are a bunch of legit reasons why a CC company can't necessarily tell you this instant that you only need to pay $x and no more to close the account (although there is no good reason why they shouldn't be able to quote your current balance).   What happens when you ""close an account"" is basically that they stop accepting new charges that were *made* after your notification, but they will still accept and bill you for legit charges that you incurred before you gave them notice. So basically, they ""turn off"" the credit-card, but they can't guarantee how much you owe until the next billing cycle after this one closes:  - You notify them to ""close"" the account. They stop authorizing new charges.   - Their merchant agreements basically give the merchant a certain window to process charges. The CC company process legit charges that were made prior to ""closing"" the account.   - The CC company sends you the final statement *after* that window for any charges has expired,  - When that final statement is paid (or if it is zero), *THAT* is when the account is settled and reported to Equifax etc as ""paid"".   So it's hard to tell from your post who was being overly semantic/unreasonable. If the CC company refused to tell the current balance, they were just being dickheads. But if they refused to promise that the current balance shown is enough to instantly settle the account forever, they had legit reasons.  Hope that helps." Credit card companies organize types of businesses into different categories. (They charge different types of businesses different fees.) When a business first sets up their credit card processing merchant account, they need to specify the category.  Here is a list of categories that Visa uses. Grocery stores and supermarkets are category number 5411. Other types of businesses, such as the examples you provided in your question, have a different category number. American Express simply looks at the merchant category code for each of your transactions and only gives you rewards for the ones in the grocery store category. It's all automated. They likely don't have a list of every grocery store in the US, and even if they did, they would probably not provide it to the public, for proprietary reasons. If you are in doubt about whether or not a particular store is in the grocery category, you'll just have to charge it to your card and see what happens. Often, the category of transaction will be shown for each transaction on your credit card's website. "Do not store credit cards on your servers! You will get into HUGE trouble if they get stolen.  Instead, the whole credit card transaction should be done in a ""frame"" on a web that is handle by a credit card processor you chose. Once the transaction is finished, you get a code for the credit card number (masked credit card number) that no-one can convert back to a credit card number (except the processor).  When you need to charge more or give refund, you use that code to tell the processor what credit card to make the charges/credits to." It depends on the seller.  If the seller wants, they can collect the information from you and send it to the payment gateway.  In that case, they of course have everything that you provide at some point.  They are not supposed to keep the security code, and there are rules about keeping the credit card number safe.   The first four digits of the credit card number often indicate the bank, although smaller banks may share.  But for example a Capital One card would indicate the bank.   Other sellers work through a payment gateway that collects the information.  Even there, the seller may collect most of the information first and send it to the gateway.  In particular, the seller may collect name, email, phone, and address information.  And in general the gateway will reveal that kind of information.  They will not give the seller credit card info other than the name on the card, expiration date, and possible last four digits.  They may report if the address matches the card's billing address (mismatched addresses may mean fraud).   Buying through someone like PayPal can provide the least information.  For a digital good, PayPal can only expose the buyer's name (which may be a business name) and email (associated with the payment account).  However PayPal still has the other information and may expose it under legal action (e.g. if the credit card transaction is reversed or the good sold is illegal).  And even PayPal will expose the shipping address for physical goods that require shipping. Merchants are only supposed to verify the presence of a signature, which signifies that the card owner has accepted the terms and conditions of the card / account. It was never really intended to be used to authenticate the card holder, nor is it used as such in practice. This is a question with a flawed premise.  Credit cards do have two-factor authentication on transactions they consider more at risk to be fraudulent.  I've had several times when I bought something relatively expensive and unusual for me, where the CC either initially declined and sent me a text asking to confirm immediately (after which they would approve the charges), or approved but sent me a text right away asking to confirm (after which they'd automatically dispute if I told them to).  The first is legitimately what you are asking for; the second is presumably for less risky but still some risk transactions). Ultimately, the reason they don't allow it for every transaction is that not enough people would make use of it to be worth their time to implement it.  Particularly given it slows down the transaction significantly (and look at the complaints at the ~10-15 seconds extra EMV authentication takes, imagine that as a minute or more), I think you'd get a single digit percentage of people using that service. My understanding it that the signature requirement is at the retailer's discretion. If the merchant decides to require a signature it protects them against fraudulent charge-back claims, but increases their administrative costs. In some situations it just isn't practical for a retailer to require a signature. Consider for example mail-order or online purchases, which I've never had to sign a credit card slip for. "Here's another rational reason: Discount. This typically works only in smaller stores, where you're talking directly to the owners, but it is sometimes possible to negotiate a few percent off the price when paying by check, since otherwise they'd have to give a few percent to the credit card company. (Occasionally the sales reps at larger stores have the authority to cut this deal, but it's far less common.) Not worth worrying about on small items, but if you're making a large purchase (a bedroom suite, for example) it can pay for lunch. And sometimes the store's willing to give you more discount than that, simply because with checks they don't have to worry about chargebacks or some of the other weirdnesses that can occur in credit card processing. Another reason: Nobody's very likely to steal you check number and try to write themselves a second check or otherwise use it without authorization. It's just too easy to steal credit card info these days to make printing checks worth the effort. But, in the end, the real answer is that there's no rational reason not to use checks. So it takes you a few seconds more to complete the transaction. What were you going to do with those seconds that makes them valuable? Especially if they're seconds that the store is spending bagging your purchase, so there's no lost time... and the effort really isn't all that different from signing the credit card authorization. Quoting Dean Inge: ""There are two kinds of fool. One says 'this is old, and therefore good.' The other says 'this is new, and therefore better.'""" "I don't think the reason is ""to verify that it is truly me"". It should be possible for someone else (friend, relative...) to make a payment on your behalf, using their own card. It is common that ""gift cards"" are not per-authorized for ""Card Not Present"" (CNP) use like on the internet, or over the phone. In many cases, you can register your card, online or by speaking to a representative over the phone. After that, you should be able to use it to pay your phone company. Also, depending on where you got the card, you may be able to go to a teller at the issuing bank, and withdraw cash (or get a check), possibly without a fee." "Actually in Finland on some bank + debit/credit card + online retailer combinations you type in your card details as you normally do, but after clicking ""Buy"" you get directed to your own bank's website which asks you to authenticate yourself with online banking credentials. It also displays the amount of money and to which account it is being paid to. After authentication you get directed back to the retailer's website. Cannot say why banks in US haven't implemented this." I used to work for a online payment posting company. Anytime a payment is made via Credit Card to a company that does not have PCI DSS(aka the ability/certification to store credit card information) there is a MD5 checksum(of the confirmation code, not the Credit Card information) that get sent to the company from the processor(billing tree, paypal, etc). The company should be able to send this information back to the processor in order to refund the payment.  If the company isn't able to do this, to be honest they shouldn't be taking online credit card payments. And by all means do not send your credit card information in an email. As said above, call the company's customer service line and give them the info to credit your account.