British Airways ask for your credit card CVV to verify your identity.

This means they must be storing it, which is prohibited under PCI.

https://security.stackexchange.com/a/73195