If through phone confirmation, they just need the name, number and expiry date. No CVC code. Only during online booking, they need the CVC code. And when I say 'online booking', I meant the HTTPS transactional page, not the one where you fill up an auto-email form.