CVV digit verification is the check a merchant or payment processor runs to confirm that the 3-digit or 4-digit card verification value printed on a payment card matches the value held by the issuing bank. The code proves the buyer has the card in hand, and the merchant never stores it after the transaction is authorized. A mismatch returns a decline or a fraud flag.
How many digits does a CVV have?
Visa, Mastercard, and Discover cards use a 3-digit code. American Express uses a 4-digit code. The length is set by the card network, not by the bank that issued the card.
- Visa: 3 digits, called CVV2
- Mastercard: 3 digits, called CVC2
- Discover: 3 digits, called CID
- American Express: 4 digits, called CID
Where do you find the digits on the card?
On Visa, Mastercard, and Discover cards, the code sits on the back, inside or beside the signature panel. On American Express cards, the 4-digit code is printed on the front, above the card number on the right side.
How does the verification step work?
During an online purchase, the merchant sends the card number, expiry date, and CVV to the payment processor in the authorization request. The processor forwards the CVV to the issuing bank, which compares it against its record and returns a match, no match, or not processed response. The merchant receives the result but never the stored value.
Why can't merchants store the CVV?
PCI DSS classifies the CVV as sensitive authentication data. Requirement 3.2 forbids storing it after authorization, even in encrypted form. That rule is what keeps the code useful as proof of possession.
What does a CVV mismatch mean?
Most mismatches are simple entry errors, such as a typo or a mistyped card. Repeated failures on the same card number can indicate that the card details came from a data breach or a resold card record. Issuers often block the card after several failed attempts.
Is CVV the same as a PIN?
No. A PIN is a secret the cardholder knows and enters at an ATM or terminal. A CVV is printed on the card itself and is used for card-not-present transactions.
Are CVV codes ever dynamic?
Some virtual and tokenized cards generate a fresh CVV for each transaction or session. The digits still pass through the same issuer verification step. Traditional plastic cards keep one static code until the card is replaced.
Is buying or selling CVV data legal?
No. In the United States, using, selling, or trading another person's card verification data without authorization is card fraud. Federal law treats it as access device fraud, and penalties can include prison time and fines. Sites that advertise CVV sales are operating outside the law.