Card verification value (CVV/CVC) is the three- or four-digit security code that shows a remote payer has access to the physical card. Visa calls it CVV2, Mastercard CVC2, JCB CAV2 and American Express CID, but all are calculated alike: the issuer derives the code from card number, expiry date and service code using secret keys in its hardware security module. Only the issuer can check it, inside authorization, returning results such as M for match or N for no match; merchants can void approvals with N. PCI DSS forbids storing the code after authorization, even encrypted. With only 1,000 possible three-digit values, it invites card testing, does not count as a strong customer authentication factor and shifts no fraud liability.
What is CVV or CVC
Scheme names differ: Visa CVV2, Mastercard CVC2, JCB CAV2 and American Express CID, four digits on the front of the card.
The "2" separates the printed code from CVV1/CVC1, a different value encoded on the magnetic stripe, and from the iCVV used by EMV chips. Because the values differ, stripe data skimmed at a terminal cannot be used to shop online.
CVV vs CVC: one calculation under two names
Both are computed by the issuer from the card number, expiry date and service code, using a pair of secret keys held in its hardware security module. The code reveals nothing about those keys, and the merchant has no way to calculate or verify it.
What is a CVV check
A CVV check is the comparison the issuer makes between the code a customer enters and the value it calculates for that card. It happens inside authorization at no extra charge, and only the issuer can run it. Merchants saving a card often send a zero-amount verification to get a result at storage.
How does CVV verification work
The code travels in the authorization request through the gateway, acquirer and card network to the issuer, which returns a result code with its decision. On Visa the results are M (match), N (no match), P (not processed), S (merchant indicated no code, though the card should carry one) and U (issuer does not support the check). Mastercard uses equivalent codes.
CVV check in online payments
Issuers do not always decline on N; many approve and leave the call to the merchant. A careful merchant configures its gateway to reject that approval: for a €75 order approved with result N, the system issues a void, releasing the hold before capture and before goods ship.
PCI DSS classes the code as sensitive authentication data that may not be kept after authorization, even encrypted. Subscription renewals therefore run on stored-credential flags and tokens instead. A payment company found writing CVVs into application logs has a serious PCI finding, and buyers look for exactly this in data-flow reviews.
Where the CVV check falls short
A three-digit code has only 1,000 possible values. Fraudsters test stolen numbers with small payments, cycling guesses across many merchants so no single site sees enough failures to react; per-card and per-IP velocity limits are the usual defence. Phishing and checkout skimming scripts capture the code along with the number.
The European Banking Authority does not count details printed on the card as a strong customer authentication factor, so an EEA online payment still needs authentication or an exemption. A CVV match does not shift fraud liability either: only authentication through 3-D Secure 2 moves it to the issuer.
See also: QR code payment.