No one can withdraw money or make a transaction if they know your CVV. Someone will need to have access to both your card and your secret PIN to do so. To complete a transaction as well, they will need your secret PIN or the OTP that gets sent to your registered mobile number.