Support agents usually ask for a security phrase or information about your address to verify your identity.
British Airways ask for your credit card CVV to verify your identity.
This means they must be storing it, which is prohibited under PCI.
https://security.stackexchange.com/a/73195