CreditCard.cvv2 type should be string (per guidance from API team)