Identification problem
suppliers *must* NOT store your CVV number in their database
they must validate the CVV number, at point of sale (and now they have to go
through the CC two factor authentication)
if they don't, the loss falls to them, so what do I care?