Short answer
If you sell greeting cards or gifts online, you cannot store the CVV, CVC, or CID printed on a customer's card, and you cannot resell it. Card network rules and the PCI Data Security Standard bar merchants from keeping that number after a payment is authorized, even for a short time and even in an encrypted field. The practical route is to let a PCI-validated payment provider collect the card details, then keep only a payment token in your own order system. Everything below follows from that rule.
Prerequisites
- A merchant account with a PCI DSS Level 1 validated payment provider
- Admin access to your storefront and checkout settings
- A list of every place order data lands: shop database, email inbox, spreadsheets, chat tools
- One person named as the payment compliance owner
Steps
- Check your processor's validation status. Confirm the provider appears on the PCI Security Standards Council list of validated service providers. If it does not, move your checkout before anything else.
- Change your checkout to hosted fields or a redirect page. The card form should load from the processor's domain so the number never touches your server.
- Disable every CVV field in your own order records. Open your storefront settings and turn off any option that saves the security code to the order, the invoice, or the customer profile.
- Purge existing card verification data. Search your order database, exported CSVs, and backup archives, then delete any stored codes and note the date you did it.
- Clear your message channels. Search your support inbox, contact form logs, and chat history for customers who sent card details in writing. Delete those messages and tell the customer to re-enter the number at checkout.
- Set a retention timer for card data. Keep the last four digits and the authorization result only as long as your refund window needs them, then let the system drop the rest.
- Train anyone who takes phone or email orders. Staff should never write a security code on a notepad, and gift order takers should use a payment link instead.
- Document the result. Note your processor, your token setup, and your deletion dates in a file you can show a bank or auditor during your annual self-assessment.
Why the rule is strict
The verification value exists to prove the person paying holds the physical card. Once a merchant keeps it, that proof becomes a reusable secret. A single breach of a gift shop database can expose thousands of customers, and card networks respond with fines and lost processing rights. Selling the data is worse: it is fraud, and it invites criminal liability rather than revenue.
Mistakes common in small gift stores
- Storing the code in a custom order field added by a developer
- Forwarding order confirmation emails that include full card details
- Using a spreadsheet to track gift orders and copying card numbers into it
- Assuming a small shop is out of scope for PCI DSS
Tokenization solves most of this. The processor returns a reference string you can charge again for a replacement gift or a backorder, and your database holds nothing a thief can use.