What is a CVV, and why is it not stored anywhere?
The card number can be stolen from a database. The three digits on the back cannot, because no database is allowed to have them.
Everything but the part that proves you were holding it.
What it is actually proving
Every card carries data that can be copied without the card. The number is printed on the front, embossed, read by terminals and stored in a thousand merchant databases. The expiry is short enough to guess. The name is public.
The CVV is different in one specific way: it is not stored anywhere downstream. Card rules prohibit merchants, gateways and processors from retaining it once a transaction is authorised. So when a database leaks, the leak contains numbers, expiries and names, and it does not contain CVVs.
That is the whole design. The code is not clever cryptography from the user's side. It is a piece of information that only exists on the physical card and in the issuer's own systems, which means presenting it is weak evidence that you are holding the thing.
Why it stopped being enough
Because weak evidence degrades. CVVs can be captured at the moment of entry, by a compromised checkout page, a skimming script, a phishing form or a merchant that breaks the rules. They can also be guessed: a three-digit code has a thousand combinations, which is trivial to brute force unless the issuer limits attempts, which is why issuers limit attempts.
More fundamentally, a code that must be transmitted to be used cannot protect against an attacker who is watching the transmission. This is exactly why authentication moved to 3D Secure, where the issuer verifies you through a channel the merchant never sees, and why tokenisation replaced stored card numbers with values that are useless elsewhere.
The CVV is now one signal among several rather than the check that matters.
What this means practically
Never save a CVV anywhere, and treat any site that offers to remember it as a site breaking the rules.
A merchant asking for your CVV on a repeat purchase is not being awkward. They are required to ask, because they are required not to have kept it. Legitimate subscription charges are the exception: a recurring payment is flagged as merchant-initiated and does not carry a CVV at all, which is a design decision rather than an oversight.
And a request for a CVV over the phone, by message, or from anyone who contacted you first, is the clearest fraud signal in consumer payments. The code exists to prove the card is in front of you. Nobody legitimate needs it read aloud.
A stranger phones claiming to be standing in your kitchen. You do not ask for your own address, which is on the electoral roll. You ask what is stuck to the fridge door. It is not a secure question. It is just a question that is hard to answer from far away.
Where you meet it
Every online checkout asking for three digits you have to turn the card over to read. Every subscription that renews without asking. Every call from someone claiming to be your bank who needs it "to verify".