What Is CVV?
CVV (Card Verification Value) is a card security value used as an additional card-not-present verification signal. Providing the correct value can indicate access to the card information including the security code, but does not prove the customer's identity or guarantee possession of the physical card.
Direct Answer
CVV (Card Verification Value) is a card security value used as an additional card-not-present verification signal. Providing the correct value can indicate access to the card information including the security code, but does not prove the customer's identity or guarantee possession of the physical card.
Direct Answer
CVV (Card Verification Value) — also called CVV2, CVC, or CID depending on the network — is a card security value printed on a payment card. It is used as an additional card-not-present verification signal. Providing the correct value can indicate that the person entering the transaction has access to card information that includes the security code, but it does not prove the identity of the customer or guarantee possession of the physical card.
How It Works
At online checkout the customer enters the card number and the CVV. The gateway sends the CVV to the issuer for verification, and the result is returned as part of the authorization response. The CVV is printed on the card and is not encoded on the magnetic stripe. Matching the CVV is a risk signal; it is not proof that the customer is the legitimate cardholder, because stolen card data may include the security code.
Key Points
- CVV is the security code on the card, distinct from the card number.
- It is used as an additional card-not-present verification signal.
- A correct CVV does not prove identity or physical possession of the card.
- Sensitive authentication data such as card verification codes is subject to strict PCI DSS restrictions and should not be stored after authorization.
What Merchants Should Know
Collect CVV for online transactions and configure your gateway to decline mismatched results where appropriate. Do not store CVV data after authorization — doing so violates PCI requirements. Combine CVV checks with AVS and 3-D Secure for layered fraud protection, and never share or mishandle card-security data.
