Two different kinds of card data
A magnetic stripe is a machine-readable record of account information used when a card is swiped. A reader can copy that stripe data, which may let a criminal make a counterfeit card for use at a terminal that still accepts magnetic-stripe transactions.
The card verification value—the short security code printed on the card—is separate. It is meant to provide a piece of information that a stripe reader cannot collect during a swipe. That separation limits what a stripe-only copy reveals, but it does not make the account safe from every kind of theft.
What the code tells a seller
For an online or phone purchase, a seller can ask the customer to enter the code and send it along with the payment request. The card issuer or payment system can check whether the submitted value matches the one associated with the account. A match is a useful signal that the buyer has access to more than the card number alone.
But the check is not proof of who is making the purchase. Someone who has stolen the physical card, photographed it, or obtained its details through another means may know the code too. The code therefore helps screen transactions; it cannot replace other fraud controls or establish that the person entering it is the cardholder.
That distinction explains why a copied stripe and an online purchase pose different risks: the stripe copy supplies data for a swipe, while a remote checkout may demand an additional value that the stripe never carried.
