I rarely place orders over the phone, but don't recall having been asked for the CVV in those cases. Since much of the fraud has to do with snapping pics of both sides of the card by servers, they should have the CVV to enter to obtain their loot.