I am using ping command to test my website which is running on a local server at the moment. 
Most likely answer:


They don't have to (it's not a PCI requirement)
It's better from a UI/support standpoint


Let's keep this in perspective.  This is the number that's printed, on the back of the card, right where minimum-wage cashiers are instructed to visually inspect when performing a POS transaction.  Absolute secrecy from physical bystanders is clearly not the intended control for the CSC!

Pay attention rather to the aggressive controls the PCI DSS imposes to ensure it's never stored by anyone in the processing chain.  They are not concerned with onesie-twosies being shoulder-surfed, they're concerned with the people who steal credit card databases getting away with the CSC too.
