Old credit card required to update child’s age

I’m trying to change my child’s age and am being asked for a cvc for my credit card. Firstly, as I have facial recognition on my phone, why is this necessary - it makes me very nervous how do I know this is a real Apple website?! Secondly, the credit card on file is now invalid and there’s no option to update it. So I’m stuck!