sony still store full cc details

Just a warning to anyone who has a CC or DC on psn.

Basically i ordered some cheap ps1 retro games on psn and paid with funds in the wallet.

I then had to verify my credit card on file for security even tho it wasnt used for payment, because i last signed in on a different console (ps4).

The problem is the card on my psn account expired last month, so I knew the verification would either fail (if they were doing test transaction) or it would pass because they could check with all the details on file, it passed. So they storing the 3 digit number that no one is supposed to store.

As far as I am aware, they only ask for the 3 digit code when you first register for initial verification of the card details and don't use it for subsequent purchases. That's why they claim they never store it. I was certainly never asked about any card details when purchasing, which is the whole point, to streamline the process.

I use PayPal instead now but they don't need you to enter CSC codes every time either. How do you know they are using the code subsequently? Does that definitely need to be an ongoing part of the process, or are there other metrics that need to change before it raises concern?

Never have and never will use a CC or DC on PSN
I just buy the cards from the shops

the card has been on file for over a year, this payment was done by paypal (funds added to wallet). So the credit card was just used to verify I am the account holder. It seems sony have an extra security step in place if you use the store across different consoles.