As per Visa / MasterCard card network rules, an Issuer Bank – SBI in your case – can process a credit card or debit card payment with only two pieces of information, namely, Card # and Expiry Date. Although this is not a widely known fact, it’s upto the Issuer to consider or ignore other information like Name, CVV, etc. while processing a card payment. Given below are two examples of my (non SBI-issued) credit card payments that went through without CVV.
1.
Just paid online with credit card for subscription of a US magazine. Let alone Mobile OTP / VbV / MSC, the website didn't even ask for CVV! I loved the frictionless CX. Although I'll hate the consequences of such lax security, should I ever face them! pic.twitter.com/wzAcbWfg2B
— GTM360 (@GTM360) July 16, 2018
2.
PSA: Catalog Shopping never took off in India but the enabling MOTO mode for processing credit cards works on Indian POS machines. Used by magazines, coworking offices, et al, Mail Order Telephone Order processes payments with Card # & Expiry Date – no need for Name or PIN/CVV. pic.twitter.com/HoL6LYuKMP
— Ketharaman Swaminathan (@s_ketharaman) December 5, 2018
See Ketharaman Swaminathan’s answer to I told my debit card number and expiry to a fraud call.And also that it is a VISA card. Is it possible to use money without CVV? What should I do next? Where can I report this? and Ketharaman Swaminathan’s answer to Will Netflix return my money if I don’t enter my CVV? for more details.