CVV Numbers (by Graham King)

CVVs, CVV2s, CVCs, and Indent CVCs are 3-digit Card Verification Values or Card Verification Codes that are all calculated using the same CVV algorithm. These values are required by payment systems such as Visa and MasterCard to authenticate their credit or debit cards. Different names are used to refer to the values depending on the particular payment system, the location of the value on the card, and the parameters passed to the CVV algorithm.

To calculate a 3-digit CVV, the CVV algorithm requires a Primary Account Number (PAN), a 4-digit Expiration Date, a 3-digit Service Code, and a pair of DES keys (CVKs).

Besides the obvious CVV variations provided by different PANs and expiration dates, most card issuers will use different CVKs for different batches of cards. Cards can be grouped by bank, by ATM network, or by other means of identifying a certain group of cards. Cards in the same batch will often use the same service code. This service code to the CVV algorithmis usually non-zero. One CVV variant, now commonly called CVV2 (Visa), or Indent CVC (MasterCard), uses ‘000’ as the service code parameter to the CVV algorithm. Sometimes a card will have both a traditional CVV and a CVV2.

Another variation to the CVV algorithm can be introduced by changing the format of the expiration date. While the date is always the concatenation of the 2-digit month (MM) andlast 2 digits of the year (YY), it can be in either YYMM or MMYY formats. For instance, Visa CVV2s are usually calculated using the YYMM format.

Author: Graham King

CIA Advice for US Government Operatives Infiltrating Schengen

Executive Summary
The European Union’s Schengen biometric-based border-management systems pose a minimal
identity threat to US operational travelers because their primary focus is illegal immigration and
criminal activities, not counterintelligence, and US travelers typically do not fit the target profiles.
US-documented operational travelers are not required to provide biometric data when crossing
the Schengen area’s external borders. (S//NF)
The European Union’s creation of the Schengen area led to increased freedom of movement within the
internal borders of its member states. Concurrently, the European Union has strengthened its external
border security to prevent illegal immigrants and criminals from entering the Schengen area, where they
would have freedom to travel unchecked from state to state. With the EU's assistance, Schengen
member states have strengthened their external borders with specialized training; high-tech surveillance,
inspection, and communications equipment; and vehicles and aircraft. The member states use computerbased
watchlist systems at the external borders that are connected to common databases. The
European Union has developed a number of database systems to promote information sharing while at
the same time balancing privacy and security concerns. The European Union has an ongoing process to
incorporate biometrics into these various systems to augment its law enforcement measures and to
enhance immigration control by improving the identification and verification of travelers entering the
Schengen area. (U)