I just ran in to this issue on a site - namely setting "CVV required for backoffice" to 'no' results in it CVV fields showing as 'not required' site wide, ie on all public facing contribution pages.

I found a question about this here https://forum.civicrm.org/index.php?topic=34624.0

If this was the intended and desired outcome then at least the help text and label should be updated.

Noting that on 4.6 this is at civicrm/admin/setting/url?reset=1

At 4.7 it is at civicrm/admin/setting/preferences/contribute?reset=1

What should next step be? Have it perform as described, or describe how it performs?

  • 1
    That sounds like a bug to me. I'm pretty sure the intent was to just provide the option to disable it in the backend. Feb 23 '17 at 3:02

This is a bug and I have opened a JIRA ticket and will update when something comes of that.

  • As this is being fixed - it may be good to add a warning bubble that some payment processors require CVV codes - or you'll not be able to payment process at all. It's essentially an additional security check. So turning off CVV codes is not unlike: "would you like to scale down your Fraud prevention strategies". Come to think of it - perhaps no-one should be presented with that option! Feb 24 '17 at 1:28
  • You mean 'no-one' at front end? or either?
    – petednz - fuzion
    Feb 24 '17 at 1:53
  • I'm thinking best to not let anyone disable it anywhere. CVV is a good thing - from a security/fraud prevention point of view. It also helps to prevent accidental charges. For example AMEX does not care about expiry date (you can type in any date in future - and card will process) - so you're left with 15 digits - any typo in those digits - any you're charging someone else. Requiring CVV will help prevent such accidental charges as well. Feb 24 '17 at 2:41
  • but if the payment processor allows an admin to enter a payment without cvv (eg a recurring one), but if civicrm does not allow this, then we end up with recurring payments being set up via the PP, rather than via Civi and hence get bad reporting of transactions in civi
    – petednz - fuzion
    Feb 24 '17 at 19:43
  • Requiring CVV is a good one from a fraud prevention viewpoint - even if a payment processor does not require it. Feb 24 '17 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.