Square uses the CVC number on the back of the card as a pin for this currently. It's not the most secure way to handle it imo, but it does stop the general user from picking up a phone and stealing all their money from snapchat (if this feature carries over to snapcash).

Strange, why not just have the user choose a password or a typical 4-digit pin? This would still be way more secure than using the CVC number.