Well,

    Once you get the Expiry Date (which is the most prevalent data that is not encoded with the CHD)

    CVV is only 3 digits, we saw ppl using parallelizing tactics to find the correct sequence using acquirers around the world.

    With the delays in the reporting pipeline, they have the time to completely abuse that CHD/Date/CVV before getting caught.

For chipless markets ( You know who you are )

    I'm way more worried about Pinpads carrying Track1+Track2 unencrypted thru Serial, USB, Bluetooth, Wireless custom connection...

    ( I snooped Serial, USB, Bluetooth for a Pinpad PA-DSS project )

    And with the PA-DSS spec being dropped by 2020 it will become worst.

-----
Alain Hebert                                ahebert@pubnix.net   
PubNIX Inc.        
50 boul. St-Charles
P.O. Box 26770     Beaconsfield, Quebec     H9W 6G7
Tel: 514-990-5911  http://www.pubnix.net    Fax: 514-990-9443

On Wed, Oct 10, 2018 at 02:21:40PM +0000, Naslund, Steve wrote:

For example, with tokenization there is no reason at all for any
retailer to be storing your credit card data (card number, CVV, exp
date) at all (let alone unencrypted) but it keeps happening over
and over.

It's been a while since I've had to professionally worry about this,
but as I recall, compliance with PCI [Payment Card Industry] Data
Security Standards prohibit EVER storing the CVV.  Companies which
do may find themselves banned from being able to process card
payments if they're found out (which is unlikely).
	- Brian