Saved Payment Methods Skip the CVC, and 34% Never Notice
About one in three American online casino and sportsbook customers who deposit with a stored card or bank credential never re-enter the three- or four-digit security code at checkout, and roughly a third of that group could not tell you the last time they did. The number comes from a deposit-flow audit of 14 U.S.-facing operators run across the first quarter of 2026, and it lands on a specific figure: 34% of returning depositors complete a transaction on a saved method without any fresh CVC entry, and 34% of those same users, when surveyed afterward, did not remember skipping it. The CVC has quietly become optional in the places players least expect to look.
That is not a scandal in itself. Tokenization, network tokens, and stored-credential frameworks were built to remove exactly this friction, and the card networks have spent a decade pushing merchants toward them. But the gap between how the checkout behaves and what players believe about it has real consequences for fraud liability, chargeback disputes, and the practical question of who is holding the risk when a deposit goes wrong at 2 a.m. on a Sunday.
What "saved payment method" actually means at a U.S. sportsbook
The phrase covers at least four different technical arrangements, and operators rarely distinguish between them in their help pages.
- Network tokenization. The card networks replace the 16-digit PAN with a device- or merchant-specific token. The CVC is validated once at token creation and typically not again. Visa and Mastercard both report that the large majority of their U.S. e-commerce volume now runs on tokens rather than raw card numbers.
- Merchant-side vaulting. The operator stores an encrypted credential in its own vault or a processor's, and the CVC is either not stored (per PCI rules it generally can't be) or is re-requested on a schedule the operator sets.
- Bank-based credentials. ACH-style transfers and open-banking handoffs, where there is no CVC at all and authentication runs through the bank's own login or a risk score.
- Wallet pass-through. PayPal, Apple Pay, Google Pay, and similar, where the wallet authenticates the user and the underlying card's CVC is irrelevant to the merchant.
The 34% figure in the audit is drawn from the first two categories — card deposits on a saved credential — because that's where players most often assume a CVC is still being checked. In the wallet and bank categories, nobody expects a CVC, so the surprise doesn't register. The friction sits specifically on the saved-card path, which remains the single largest deposit rail for U.S. online sportsbooks and a substantial share of casino cashier traffic.
Why the CVC check became optional
Under the card networks' stored-credential rules, a merchant that has a valid token or a properly flagged stored credential can process a subsequent transaction without the CVC, provided it transmits the correct indicator and accepts the liability shift that comes with it. In practice, many operators take the shift because the fraud math favors it: a declined deposit costs a real customer, and a customer lost at deposit is often a customer lost for the session. The CVC re-prompt, by the operators' own testing, adds abandonment.
One payments lead at a mid-size U.S. operator, who asked not to be named because his company doesn't discuss fraud controls publicly, put the tradeoff plainly: re-prompting the CVC on every deposit cut completed deposits by a low-single-digit percentage and cut fraud losses by less than the revenue it cost. The company stopped re-prompting. That is a defensible business decision and an entirely normal one across e-commerce. It is also why the 34% exists.
The 34% who don't notice — and why the number is probably soft
The audit's second 34% is the more interesting one. After the deposit-flow review, the same panel of roughly 2,400 U.S. adults who had deposited at an online operator in the prior 90 days was asked a simple question: "The last time you deposited using a saved card, did you enter the security code?" A third said yes. A third said they didn't remember. A third said no. Cross-referencing the answers against the actual flow logs, a meaningful share of the "yes" answers were wrong — the flow had not requested a CVC. The 34% who "never notice" is really a floor, not a ceiling.
That matters because consumer understanding of checkout security is doing work it wasn't designed to do. Players use the presence or absence of a CVC prompt as a rough proxy for how locked-down an account is. If the prompt disappears, the inference many draw is that the operator has decided the account is trusted — which is sometimes true and sometimes just a configuration default set months ago and never revisited. The CVC prompt is not a security dashboard. It's a merchant setting.
What the player is actually trusting
When a saved card skips the CVC, the authentication that remains is a mix of device fingerprinting, IP and geolocation checks, behavioral scoring, account-level velocity limits, and the operator's own login controls. Some of that is robust. Some of it is a rule that says "more than three deposits in an hour from a new device triggers a review." The variance between operators is wide, and none of it is visible at the cashier.
For the player, the practical exposure is narrower than it sounds but not zero. If someone else deposits on your saved card — a family member, a roommate, a person who has your unlocked phone — the transaction will often clear without the CVC. Whether that becomes your problem depends on the operator's terms, the card issuer's dispute process, and how quickly you report it. Card issuers generally treat "authorized user made the purchase" and "fraudulent use of a stored credential" very differently, and the line between them is where most of these disputes actually get decided.
The chargeback question nobody wants to answer on the record
Here is where the friction becomes concrete. Under the card networks' chargeback reason codes, a transaction processed with a stored credential and the correct indicator is harder to dispute on the grounds that the cardholder didn't authorize it — the merchant has a documented prior authorization and a token. That's the point of the framework, and it's why operators like it. But it also means a player who genuinely didn't make a deposit may find the dispute harder to win than they expect, because the operator can show a stored credential that was created with a CVC at some earlier date.
The reverse is also true. Operators that skip the CVC on a stored credential without transmitting the correct indicator — a configuration error that shows up more often than the industry likes to admit — can lose chargebacks they should have won, because the transaction looks like a card-not-present purchase with no authentication. Both errors happen. Neither is visible to the player until something goes wrong.
Regulators have started to notice the asymmetry without quite naming it. State gaming regulators in several jurisdictions have asked operators to document their deposit authentication flows as part of routine compliance reviews, and the questions tend to focus on whether the operator can demonstrate that a deposit was authorized by the account holder. A stored credential with a CVC captured six months ago is an answer. It is not always a satisfying one.
What the numbers say about who is exposed
The audit's demographic cut is where the story gets less abstract. Players who deposited more than 20 times in the prior 90 days were substantially more likely to have a saved method that skipped the CVC — not surprising, since frequent depositors are exactly the users operators most want to keep frictionless. Players over 55 were the least likely to have noticed the change, and the most likely to believe the CVC was still being checked. That combination is the one that shows up in complaint data.
It also shows up in a quieter place: shared devices. Roughly one in five respondents in the panel reported that at least one other adult in their household had access to the device they used to deposit. In households where a saved card skips the CVC, that access is a deposit path. Most of the time nothing happens. Sometimes a teenager with a phone and a sportsbook account that was left logged in turns out to be a fraud dispute with a very awkward paper trail.
The responsible-gambling angle here isn't moralizing about who should have access to a device. It's that deposit friction is one of the few natural circuit breakers in a system otherwise designed to remove every obstacle between a player and a wager. Session limits, deposit limits, and time-out tools are the primary controls, and they work when players set them. The CVC prompt was never a responsible-gambling tool, but its disappearance removes one small moment of pause that some players relied on without ever articulating it.
The operator's side of the ledger
It would be easy to write this as a story about operators cutting corners. The more accurate version is that operators are making a rational trade under rules the card networks wrote, and the rules were written to reduce cart abandonment across all of e-commerce, not to serve the specific risk profile of a sportsbook at 11:58 p.m. on a Sunday before a primetime game. The friction that gets removed is friction the networks consider dead weight. For a casino or sportsbook, some of that "dead weight" was doing useful work.
A few operators have gone the other way and re-introduced a step-up challenge — not a full CVC re-entry, but a biometric check or a PIN on deposits above a threshold or from an unrecognized device. The ones that have tested it report the abandonment cost is concentrated in a small slice of users and the fraud and dispute savings are real. It hasn't become standard, and it probably won't until either a regulator pushes or a high-profile incident makes the cost of not doing it legible.
The open question: who is supposed to tell the player?
Nothing in current U.S. practice requires an operator to tell a player that a saved card will skip the CVC. The card networks' rules govern the merchant's obligations to the network, not the merchant's obligations to the customer. State gaming regulations focus on account security and unauthorized access, and a stored credential that was authorized once is generally treated as authorized thereafter unless the player revokes it. The player's realistic recourse is to remove the saved method, which most cashiers make possible and few players ever do.
So the question worth asking isn't whether the 34% is a scandal. It isn't. The question is whether the industry can keep treating "the player didn't notice" as an acceptable default for a security control that players believe is still in place. There's a version of this where operators add a one-line disclosure at the cashier — "this card is saved; your security code won't be requested" — and nothing else changes. There's a version where they don't, a dispute goes badly for a player who genuinely didn't make the deposit, and a state regulator decides the disclosure should be mandatory. The 34% who never notice are, for now, the group with the least information and the most exposure. Whether that stays true is a choice the industry is making one configuration screen at a time.