Good morning Mark,
I’ve added some answers below for you.
1. CCV is empty – does that mean token payments does not check CCV? If so could this be a security issue?That’s correct, token payments do not require the CCV because the payment is being initiated by the merchant, rather than the customer.This doesn’t really pose an issue, as the banks are not expecting to see the CCV on a token payment.2. If CCV is entered, will it check CCV is valid? If so, when does it perform the check – at the point of saving the customer or token charge?If a CCV is entered when storing a customer, a check is not completed to see if it is valid. CCVs are only validated by the banks, and this only occurs when a payment is processed, such as when using ChargeCard, or the instant payment function in SaveCustomer. If you’re just using SaveCustomer to store a token, then charging it through ProcessRealtimeTokenPayment, then there is no validation completed on the CCV.
3. If CCV is not required or not checked do you suggest we remove the CCV input on the payment form to avoid confusion?Yes you can remove the CCV field if you wish.
4. After the saved customer’s card expired, will token payment fail?Generally once the card details have expired, then the transaction would fail. We are close to rolling out functionality though that will still attempt to process the expired card. This would then leave it up to the cardholder’s bank to decide whether to approve or decline a payment on an expired card.5. How do you suggest customers update the expiry of a saved card?There’s a few different API methods available to update stored payment details, such as the Embeddable Widget, or ChangeCustomerPaymentInfo.

Kind regards,Dale

Hi Mark,
It’s actually industry standard that Token payments don’t require a CCV, since Token payments are generally seen as recurring payments, or repeat payments against a previously saved card, so the banks do not require or expect the CCV, since it’s against PCI DSS to store the CCV.
I don’t really see Token payments as a less secure payment option, since you’re still at the same level of risk of a chargeback regardless of whether the customer provided the CCV or not, and in my experience, some banks don’t even check the CCV, so you could still potentially get successful payments when providing the wrong CCV.

Most other integrators just use ChargeCard or the Hosted Payments Page for one off payments, so you’re actually in a bit of a unique situation where you are storing the customer as a token first, then submitting the payment against their card through ProcessRealtimeTokenPayment, whereas most others would just use SaveCustomer if they wanted to process a payment and store a token at the same time.