question: why usual purchases with a card need something memorable (PIN code), but online purchases have their secret code printed right on the card?
comment: This is something that is changing in the EU. They are going to add in 2 factor authentication for cards. For example one of the cards I have requires me to unlock my banking app using my pin or fingerprint and approve the transaction. Effectively requiring someone to steal and unlock your phone and card. Currently it's not uncommon for Visa or Mastercard to add a secondary check where you enter a password as part of the transaction.
passages: Credit card security relies on the physical security of the plastic card as well as the privacy of the credit card number. Therefore, whenever a person other than the card owner has access to the card or its number, security is potentially compromised. Once, merchants would often accept credit card numbers without additional verification for mail order purchases. It's now common practice to only ship to confirmed addresses as a security measure to minimise fraudulent purchases. Some merchants will accept a credit card number for in-store purchases, whereupon access to the number allows easy fraud, but many require the card itself to be present, and require a signature (for magnetic stripe cards). A lost or stolen card can be cancelled, and if this is done quickly, will greatly limit the fraud that can take place in this way. European banks can require a cardholder's security PIN be entered for in-person purchases with the card.
   Section::::Online, phone, and mail order transactions.
  
  While EMV technology has helped reduce crime at the point of sale, fraudulent transactions have shifted to more vulnerable telephone, Internet, and mail order transactions — known in the industry as card-not-present or CNP transactions. CNP transactions made up at least 50% of all credit card fraud. Because of physical distance, it is not possible for the merchant to present a keypad to the customer in these cases, so alternatives have been devised, including
   Some suppliers claim that transactions can be almost twice as fast as a conventional cash, credit, or debit card purchase. Because no signature or PIN verification is typically required, contactless purchases are typically limited to small value sales. Lack of authentication provides a window during which fraudulent purchases can be made while the card owner is unaware of the card's loss.
   For this reason, Internet business and many other transactions require a more stringent authentication process. The use of digital certificates issued and verified by a Certificate Authority (CA) as part of a public key infrastructure is considered likely to become the standard way to perform authentication on the Internet. 
  
  Logically, authentication precedes authorization (although they may often seem to be combined).
  
  Section::::Identification, authentication and authorization.:Authorization.
   Other types of identity theft have become more common in Sweden. One common example is ordering a credit card to someone who has an unlocked letterbox and is not home in the daytime. The thief steals the letter with the credit card and then the letter with the code which typically arrives a few days later. Usage of a stolen credit card is hard in Sweden, since an identity document or a PIN code it is normally demanded. If the shop does not demand that, it must take the loss from stolen credit cards. The method of observing someone using the credit card PIN code, stealing the card or skimming it, and then using the card, has become more common.
   In some countries, credit and debit cards are only processed via payment terminals. Thus one may see quite a number of such terminals for different cards cluttering up a sale counter. This inconvenience is however offset by the fact that credit and debit card data is far less vulnerable to hackers, unlike when payment cards are processed through the POS system where security is contingent upon the actions taken by end-users and developers.
   BULLET::::- The second code, and the most cited, is CVV2 or CVC2. This code is often sought by merchants for card not present transactions occurring by mail, fax, telephone or Internet. In some countries in Western Europe, card issuers require a merchant to obtain the code when the cardholder is not present in person.
  
  BULLET::::- Contactless cards and chip cards may supply their own electronically generated codes, such as iCVV or a "dynamic" CVV.
  
  Section::::Location of code.
   Despite widespread use in North America, there are still a large number of countries such as China and India that have some problems to overcome in regard to credit card security. Increased security measures include use of the card verification number (CVN) which detects fraud by comparing the verification number printed on the signature strip on the back of the card with the information on file with the cardholder's issuing bank. 
   Section::::Profits, losses, and punishment.:Credit card companies.
  
  To prevent being "charged back" for fraud transactions, merchants can sign up for services offered by Visa and MasterCard called Verified by Visa and MasterCard SecureCode, under the umbrella term 3-D Secure. This requires consumers to add additional information to confirm a transaction.
  
  Often enough online merchants do not take adequate measures to protect their websites from fraud attacks, for example by being blind to sequencing. In contrast to more automated product transactions, a clerk overseeing "card present" authorization requests must approve the customer's removal of the goods from the premises in real time.
   For card not present transactions where the card is not shown (e.g., e-commerce, mail order, and telephone sales), merchants additionally verify that the customer is in physical possession of the card and is the authorized user by asking for additional information such as the security code printed on the back of the card, date of expiry, and billing address.
   For the vast majority of payment systems accessible on the public Internet, baseline authentication (of the financial institution on the receiving end), data integrity, and confidentiality of the electronic information exchanged over the public network involves obtaining a certificate from an authorized certification authority (CA) who provides public-key infrastructure (PKI). Even with transport layer security (TLS) in place to safeguard the portion of the transaction conducted over public networks—especially with payment systems—the customer-facing website itself must be coded with great care, so as not to leak credentials and expose customers to subsequent identity theft. 
   Electronic verification systems allow merchants to verify in a few seconds that the card is valid and the cardholder has sufficient credit to cover the purchase, allowing the verification to happen at time of purchase. The verification is performed using a credit card payment terminal or point-of-sale (POS) system with a communications link to the merchant's acquiring bank. Data from the card is obtained from a magnetic stripe or chip on the card; the latter system is called Chip and PIN in the United Kingdom and Ireland, and is implemented as an EMV card.
   Given the lack of ability to inspect merchandise before purchase, consumers are at higher risk of fraud than face-to-face transactions. When ordering merchandise online, the item may not work properly, it may have defects, or it might not be the same item pictured in the online photo. Merchants also risk fraudulent purchases if customers are using stolen credit cards or fraudulent repudiation of the online purchase. However, merchants face less risk from physical theft by using a warehouse instead of a retail storefront. Secure Sockets Layer (SSL) encryption has generally solved the problem of credit card numbers being intercepted in transit between the consumer and the merchant. However, one must still trust the merchant (and employees) not to use the credit card information subsequently for their own purchases, and not to pass the information to others. Also, hackers might break into a merchant's web site and steal names, addresses and credit card numbers, although the Payment Card Industry Data Security Standard is intended to minimize the impact of such breaches. Identity theft is still a concern for consumers. A number of high-profile break-ins in the 2000s has prompted some U.S. states to require disclosure to consumers when this happens. Computer security has thus become a major concern for merchants and e-commerce service providers, who deploy countermeasures such as firewalls and anti-virus software to protect their networks. Phishing is another danger, where consumers are fooled into thinking they are dealing with a reputable retailer, when they have actually been manipulated into feeding private information to a system operated by a malicious party. Denial of service attacks are a minor risk for merchants, as are server and network outages.
   BULLET::::- Multi-factor authentication - Multi-factor authentication requires that the user uses a user id, password combined with any other form of authentication method as smartcard or biometric. Using this method decreases the likelihood that an unauthorized person can compromise your electronic security system, but it also increases the cost of maintaining that system.
   A similar system of controls can be used on physical cards. Technology provides the option for banks to support many other controls too that can be turned on and off and varied by the credit card owner in real time as circumstances change (i.e., they can change temporal, numerical, geographical and many other parameters on their primary and subsidiary cards). Apart from the obvious benefits of such controls: from a security perspective this means that a customer can have a Chip and PIN card secured for the real world, and limited for use in the home country. In this eventuality a thief stealing the details will be prevented from using these overseas in non chip and pin EMV countries. Similarly the real card can be restricted from use on-line so that stolen details will be declined if this tried. Then when card users shop online they can use virtual account numbers. In both circumstances an alert system can be built in notifying a user that a fraudulent attempt has been made which breaches their parameters, and can provide data on this in real time.
   As a security measure, merchants who require the CVV2 for "card not present" payment card transactions are required by the card issuer not to store the CVV2 once the individual transaction is authorized. This way, if a database of transactions is compromised, the CVV2 is not included, and the stolen card numbers are less useful. Virtual terminals and payment gateways do not store the CVV2 code; therefore, employees and customer service representatives with access to these web-based payment interfaces, who otherwise have access to complete card numbers, expiration dates, and other information, still lack the CVV2 code.
   As a payment card is swiped through a card reading device, referred to as a point of interaction (POI) device, at the merchant location or point of sale, the device immediately encrypts the card information. A device that is part of a PCI validated P2Pe solution uses an algorithmic calculation to encrypt the confidential payment card data. From the POI, the encrypted, indecipherable codes are sent to the payment gateway or processor for decryption. The keys for encryption and decryption are never available to the merchant, making card data entirely invisible to the retailer. Once the encrypted codes are within the secure data zone of the payment processor, the codes are decrypted to the original card numbers and then passed to the issuing bank for authorization. The bank either approves or rejects the transaction, depending upon the card holder's payment account status. The merchant is then notified if the payment is accepted or rejected to complete the process along with a token that the merchant can store. This token is a unique number reference to the original transaction that the merchant can use should they ever be needed to perform research or refund the customer without ever knowing the customer's card information (tokenization). There are also Qualified Integrator and Reseller (QIR) Companies, which are businesses authorized to "implement, configure, and/or support validated" PA-DSS Payment Applications, and perform qualified installations.
   Since the CSC is not contained on the magnetic stripe of the card, it is not typically included in the transaction when the card is used face to face at a merchant. However, some merchants in North America, such as Sears and Staples, require the code. For American Express cards, this has been an invariable practice (for "card not present" transactions) in European Union (EU) countries like Ireland and the United Kingdom since the start of 2005. This provides a level of protection to the bank/cardholder, in that a fraudulent merchant or employee cannot simply capture the magnetic stripe details of a card and use them later for "card not present" purchases over the phone, mail order or Internet. To do this, a merchant or its employee would also have to note the CVV2 visually and record it, which is more likely to arouse the cardholder's suspicion.
   BULLET::::1. Copying card details, either by writing down the numbers on the card itself or by way of modified terminals or ATMs, does not result in the ability to purchase over the Internet because of the additional password, which is not stored on or written on the card.
  
  BULLET::::2. Since the merchant does not capture the password, there is a reduced risk from security incidents at online merchants; while an incident may still result in hackers obtaining other card details, there is no way for them to get the associated password.
   A common countermeasure is to require the user to key in some identifying information, such as the user's ZIP or postal code. This method may deter casual theft of a card found alone, but if the card holder's wallet is stolen, it may be trivial for the thief to deduce the information by looking at other items in the wallet. For instance, a U.S. driver license commonly has the holder's home address and ZIP code printed on it. Visa Inc. offers merchants lower rates on transactions if the customer provides a ZIP code.
   In Europe and Canada, most cards are equipped with an EMV chip which requires a 4 to 6 digit PIN to be entered into the merchant's terminal before payment will be authorized. However, a PIN isn't required for online transactions and is often not required for transactions using the magnetic strip. However magnetic strip transactions are banned under the EMV system (which requires the PIN). In many/most European countries, if you don't have a card with a chip, you will usually be asked for photo-ID - e.g. national ID card, passport, etc. at the point of sale. Many self-service machines (e.g. ticket machines at railway stations, and self-service check-in at airports) require a PIN and chip in EMV-land (i.e. which is most of Europe, Asia, Middle East, Canada, etc.).
   In 2016, a new e-commerce technology called Motioncode was introduced, designed to automatically refresh the CVV code to a new one every hour or so.
  
  Section::::Description.
  
  The codes have different names:
  
  BULLET::::- "CID": "Card Id", "Card Identification Number", or "Card Identification Code"Discover, American Express (four digits on front of card)
  
  BULLET::::- "CSC" or "Card Security Code"debit cards, American Express (three digits on back of card)
  
  BULLET::::- "CVC2" or "Card Validation Code"MasterCard
  
  BULLET::::- "CVD" or "Card Verification Data"Discover, sometimes used as the common initialism for this kind of code
  
  BULLET::::- "CVE" or "Elo Verification Code"Elo in Brazil
   Card information is stored in a number of formats. Card numbers – formally the Primary Account Number (PAN) – are often embossed or imprinted on the card, and a magnetic stripe on the back contains the data in machine-readable format. Fields can vary, but the most common include:
  
  BULLET::::- Name of card holder
  
  BULLET::::- Card number
  
  BULLET::::- Expiration date
  
  BULLET::::- Verification/CVV code
  
  Section::::Compromised accounts.:Card not present transaction.
   Depending on the economic space, there may be a payment limit on single transactions without the need to input the PIN, and some contactless cards can only be used a certain number of times before customers are asked for their PIN. Contactless debit and credit transactions use the same chip and PIN network as older cards and are protected by the same fraud guarantees. Where PIN is supported, the contactless part of the card may remain non-functional until a standard chip and PIN transaction has been executed. This provides some verification that the card was delivered to the actual cardholder.
   The only common security measure on all cards is a signature panel, but, depending on its exact design, a signature may be relatively easy to forge. Some merchants will demand to see a picture ID, such as a driver's license, to verify the identity of the purchaser, and some credit cards include the holder's picture on the card itself. In some jurisdictions, it is illegal for merchants to demand cardholder identification. Self-serve payment systems (gas stations, kiosks, etc.) are common targets for stolen cards, as there is no way to verify the card holder's identity. There is also a new law that has been implemented that identification or a signature is only required for purchases above $50 unless stated in the policy of the merchant. This new law makes it easier for credit card theft to take place as well because it is not making it necessary for a form of identification to be presented, so as long as the fraud is done at what is considered to be a small amount, little to no action is taken by the merchant to prevent it.
  