Even if it's the bank you called about the card?

Or do you make an exception in that case?

I've had some bank recently (can't remember which one) ask me for that code to verify that I actually had the card in hand. But since I called them, I didn't see a problem with giving it. (I also called them from home, where there was no one to overhear it.)

...

Meanwhile, even without the CVV, someone who hears your account number, billing address,a nd expiration date, has everything they need to go shopping at many places online.

So I would be wary of buying things over voice phone with a card (that's not already on file with company) in a situation where people can overhear, no matter how much or little information they ask you. Because if that information was good enough for them, it's going to be good enough for any thief that overheard what you were saying and made a record of it.

And thus I don't see what CVV makes worse. It's already bad enough if they get everything other than CVV. All CVV does is extend the number of places they can use your card info, but even without the CVV they can use your card info at lots of places. (And someone who's into stealing card info they overhear probably knows where they can shop with however much of the info they got.)