CVV confirms possession of the card, not the identity of the buyer, so it complements rather than replaces other fraud tools.
The card verification value is usually three digits printed on the back of Visa, Mastercard and Discover cards, and four digits on the front of American Express cards. Networks and issuers use different names for the same code, including CVV, CVC, CVV2 and CID.
At checkout the merchant passes the code with the authorization request, and the issuing bank checks it. PCI DSS rules prohibit storing the code after authorization, even in encrypted form, which is why a returning customer is asked to enter it again.
Common questions
- What is a card verification value?
- A card verification value (CVV) is the short security code printed on a payment card. Entering it at checkout shows the buyer has the physical card, which helps stop fraud on online and phone orders where the card is not presented.
- Is CVV the same as CVC?
- Yes. CVV, CVC, CVV2 and CID are different names card networks use for the same security code. Visa uses CVV, Mastercard uses CVC, and American Express uses CID for its four-digit code.
- Can a merchant store the CVV?
- No. PCI DSS prohibits storing the card verification value after a transaction is authorized, even if it is encrypted. Merchants can store a tokenized card for repeat billing, but not the security code.