CVV vs CVC vs CID

The short answer

CVV, CVC and CID are all card security codes. The name depends on the brand: Visa uses CVV2, Mastercard uses CVC2, AMEX uses CID. The code is 3 digits for Visa/Mastercard/Discover and 4 digits for AMEX.

• Visa: CVV2, 3 digits, on the back
• Mastercard: CVC2, 3 digits, on the back
• Discover: CID, 3 digits, on the back
• AMEX: CID, 4 digits, on the front

Where each appears

For Visa, Mastercard and Discover the code is printed on the signature panel on the back. For AMEX the 4-digit CID is printed on the front above the card number.

Security code evolution

Security codes were introduced in the 1990s to combat card-not-present fraud. CVV1 is encoded in the magnetic stripe; CVV2 is printed on the card. CVV2 cannot be cloned from track data, making it more secure for online transactions.

• CVV1: encoded in magnetic stripe
• CVV2: printed on card, not in stripe
• CVV2 introduced for card-not-present security
• Cannot be cloned from track data
• Required for all online transactions

Tokenization and CVV

With tokenization, the CVV is replaced by a token for recurring transactions. The original CVV is still required for the first transaction. Tokenized cards use a dynamic CVV (dCVV) for subsequent transactions.

• Tokenization replaces PAN with token
• Original CVV required for first transaction
• Dynamic CVV (dCVV) for subsequent transactions
• Reduces CVV exposure
• PCI-DSS compliant storage

3D Secure and CVV

3D Secure (VBV/Mastercard SecureCode) adds an authentication layer on top of CVV verification. While CVV confirms card possession, 3DS confirms cardholder identity. Non VBV ranges skip the 3DS step but still require CVV.

• CVV confirms card possession
• 3DS confirms cardholder identity
• Non VBV skips 3DS but needs CVV
• Both layers can be combined
• Issuer decides 3DS enforcement

PCI-DSS requirements

PCI-DSS prohibits storing CVV after transaction authorization. Merchants must not retain, print or store CVV data. This is a core security requirement to prevent CVV theft from merchant databases.

• CVV must not be stored after authorization
• Cannot be printed on receipts
• Cannot be retained in databases
• Core PCI-DSS requirement
• Violation can result in fines and decertification

Why it matters

The security code proves the card is physically present at the time of the transaction. It is not stored in the magnetic stripe or chip, so it cannot be cloned from track data.

• Proves physical card possession
• Not stored on stripe or chip
• Cannot be cloned from track data
• Required for card-not-present transactions
• Key fraud prevention tool