They ask you to verify that you actually have the card in your possession by reading the three-digit security code on the back of the card. Now the scam is complete.