What Is CVV

What CVV is

CVV is the Card Verification Value: the small number printed on a payment card that a merchant sends with a card-not-present transaction so the issuer can confirm it is looking at a genuine card and not a number typed from memory. It is three digits on Visa, Mastercard and Discover, printed on the back, and four digits on American Express, printed on the front. It is often called CVC, CVV2, CVC2 or CVN2 depending on the brand, and it is sometimes confused with the magnetic stripe code, which is a different number with a different purpose.

• Visa, Mastercard, Discover: 3 digits, printed on the back
• American Express: 4 digits, printed on the front
• The code is generated by the issuer and never changes for the life of the card
• It is not a PIN, and it is not a secret the cardholder chooses

The four codes on a card, and which is which

A modern card carries up to four distinct verification values, and mixing them up is the single most common source of confusion. The table below sets them out.

How a CVV is used in an authorisation

When a customer buys something without handing over the card, the merchant sends three things to the issuer through the acquirer: the card number, the expiry date and the security code. The issuer compares the code it holds against the one supplied. A match is recorded as a CVV result and passed back with the authorisation decision, and the merchant can use that result as one input into its own risk decision.

• The card number identifies the account
• The expiry date confirms the card has not been replaced
• The security code confirms the number was read from the card rather than guessed
• The issuer returns a CVV result alongside the approval or decline
• A CVV mismatch is one of several common decline reasons

What a CVV does not do

It is worth being precise about the limits, because the code is widely misdescribed. A CVV is not a PIN: a PIN is entered by the cardholder and is never sent with the transaction. It is not a cryptographic signature and there is no algorithm to compute it; the issuer simply stores the value and compares. It does not expire on its own, because it is fixed at issuance, and it is not affected by a card being reissued for a lost or stolen card, where the new card gets a new code.

• Not a PIN - the PIN is never transmitted with the transaction
• Not computable - there is no algorithm that derives it from the card number
• Not a signature - it carries no secret to the holder
• Does not expire on its own, and changes only when the card is reissued

Why a matching CVV can still be declined

A correct code is necessary for a card-not-present transaction to be treated as such, but it is nowhere near sufficient. The issuer makes the final decision on the account: the funds may not be there, a velocity or fraud rule may have been triggered, the account may be closed, or the billing address may not match. A CVV mismatch, by contrast, is treated as a strong signal that the transaction is not genuine, and it is one of the reasons a declined transaction is worth retrying with a fresh authorisation rather than assuming the card is bad.

Handling a CVV correctly

Two rules matter in practice. The first is that a merchant must not store the code after the authorisation: PCI DSS treats it as cardholder data, so it is scrubbed from logs, databases and analytics. The second is that it must never be accepted from the cardholder over a channel that is not the card itself, which is what the CVV requirement is designed to prevent. A checkout that emails the code back to the customer, or accepts it through chat, has removed the only thing the check was for.

• Scrub the code from logs, databases and error reports
• Never store it beyond the transaction
• Never accept it from the cardholder as a substitute for the card
• Do not log it in full, even for debugging