CVV test localization checks one field in a checkout form across languages, regions, and card networks. The card security code is 3 digits on Visa, Mastercard, and Discover cards. It is 4 digits on American Express cards. The label, the field width, the input method, and the error message all change with locale. A test pass confirms each version accepts a valid code and rejects an invalid one.

Card network terms

  • Visa: CVV2, 3 digits, back of card.
  • Mastercard: CVC2, 3 digits, back of card.
  • American Express: CID, 4 digits, front of card.
  • Discover: CID, 3 digits, back of card.

Label terms by market

English (US) uses "security code" or "CVV". English (UK) uses "card security code". German uses "Kartenpruefnummer". French uses "cryptogramme visuel". Spanish uses "codigo de seguridad". Brazilian Portuguese uses "codigo de seguranca". Japanese uses "security code" in katakana.

Label length matters. "Kartenpruefnummer" runs 17 characters. A 60 pixel field clips it. Measure the longest string in the set before release.

Field attributes

Set autocomplete="cc-csc" so browsers and password managers target the field. Set inputmode="numeric" so mobile keypads show digits. Set maxlength to 4 and a pattern of [0-9]{3,4} to accept both code lengths. Right-to-left locales flip the form layout, not the digit order inside the input.

Validation rules

Some markets block card-not-present charges without 3-D Secure. The code stays in the form. The issuer decides the outcome. Do not remove the field for those markets. The acquirer may still require it.

Storage limits

PCI DSS treats the printed code as sensitive authentication data. PCI DSS v4.0 Requirement 3.2 forbids storing it after authorization, even encrypted. Test systems follow the same rule. Use synthetic card numbers for localization tests.

Test checklist

  1. Render the form in each target locale.
  2. Check the label does not clip at the smallest supported width.
  3. Enter a 3-digit code, then a 4-digit code.
  4. Enter letters and confirm the field rejects them.
  5. Confirm the error message is translated.
  6. Confirm the value is not written to logs or analytics.