Got hit by a new scam at an airport restaurant overseas. You order and pay online, the charge goes through, and then a minute later you get a “declined wrong CVC or expiration” message from your bank. It looks real, but it’s triggered by the restaurant.
I paid again, only to find later that my card was charged twice. The bank wouldn’t reverse it since I technically authorized the first charge.
Red flag: if your card gets to the verification text stage, your info is already correct. Any “decline” message after that is fake.
Lesson: even when it looks like your bank messaging you, double-check before paying again.