CVV
What is a card verification value (CVV)?
Card Verification Value (CVV) is a security feature on credit and debit cards: a three- or four-digit code that businesses use to authenticate a card alongside the card number and expiration date when a purchase is made. It adds a layer of verification that the person paying has the physical card in hand.
The code is not stored in the card's magnetic stripe or chip, so it's used mainly in like . It confirms a card's validity and makes it harder to use stolen card numbers, protecting both and merchants.
Key facts
- A CVV is a three-digit code on Visa, Mastercard, and Discover cards, and a four-digit code on American Express cards.
- It is printed, not embossed, and is never encoded in the magnetic stripe or chip.
- It goes by several names depending on the network and issuer: CVV2, CVC2, CID, and CSC, as well as card verification code, card verification number, card validation value, and card security value. All refer to the same printed code.
- It is used for most online and phone payments but not for in-person chip or contactless payments, where the card is read directly.
- PCI DSS prohibits merchants and from storing the CVV once a payment is authorized, even in encrypted form.
Where the CVV is located, and what it's called
The code's name, length, and position on the card depend on the card . Debit and credit cards from the same network follow the same layout.
| Network | Name | Digits | Location |
| Visa | CVV2 | 3 | Back, on the signature panel |
| Mastercard | CVC2 | 3 | Back, on the signature panel |
| Discover | CID | 3 | Back, on the signature panel |
| American Express | CID | 4 | Front, above the card number |
The generic term "security code" covers all of these. For that broader term, see .
How CVV verification works
- Entry. The cardholder types the code into the checkout form alongside the card number and expiry date.
- Transmission. The merchant's payment processor passes the code to the inside the request, without writing it to storage.
- Issuer check. The issuer recalculates the expected code from the card number, expiry date, and its own secret keys, then compares it with the code submitted.
- Result. The issuer returns an authorization decision plus a separate CVV result code. The merchant or its rules decide what to do when the code doesn't match.
Visa's CVV2 result codes:
- M: match
- N: no match
- P: not processed
- S: the card should have a CVV2, but the merchant indicated it isn't present
- U: the issuer doesn't participate in CVV2 checks or hasn't provided Visa with its keys
An issuer can approve a payment that returns N, which is why a CVV mismatch is handled as a merchant-side decline or review rule rather than left to the issuer alone.
Types of CVV
CVV1, iCVV, and CVV2
The printed code is technically CVV2. A separate CVV1 value is encoded in the magnetic stripe and checked when a card is swiped, and chip cards carry their own iCVV, a different value from the one in the stripe. Because the printed CVV2 appears in neither, skimming a stripe or chip doesn't reveal it.
Static and dynamic CVV
Most cards carry a static CVV printed at issue that stays the same for the life of the card. If it's exposed in a data breach, the card stays vulnerable until it is reissued with a new code.
Some issuers offer a dynamic CVV that changes on a set schedule and is shown in a banking app or on a small display built into the card. Because each code is valid only for a short window, a stolen number becomes useless once the code rotates. Dynamic CVVs are still uncommon.
Why the CVV matters
Because the CVV is not stored in the stripe or chip and cannot be retained after authorization, it's hard for an attacker to obtain it from skimmed or database-breached card data. A transaction that includes the correct CVV is stronger evidence that the person paying is holding the genuine card.
For merchants, checking the CVV filters out fraud attempts that rely on a stolen card number alone. A CVV mismatch can be used as a signal to decline a payment or route it for extra review. On its own it doesn't prove a transaction is legitimate; it works alongside authentication and checks.
- Card testing: in a , fraudsters submit many small payments to guess valid card numbers and CVVs, so repeated N results from one device or IP are a common velocity-rule trigger.
- Recurring charges: because the code can't be stored, and after the first one go through without a CVV, relying on the initial verified transaction instead.
