CVV 3-Digit Test: Card Security Code Guide

The CVV is the 3-digit security code on the back of most credit and debit cards. It appears in the signature panel, after the last four digits of the card number. A test charge is a small authorization a merchant sends to confirm a card is open and the code matches. The amount is often $0.00 or $1.00, and the hold drops off within a few days.

What the code is called

Networks use different names for the same idea. Visa calls it CVV2. Mastercard calls it CVC2. Discover calls it a cardmember ID. American Express prints a 4-digit card identification number on the front of the card, above the account number. All of them check that the person placing the order has the physical card in hand.

Where the digits sit

• Visa, Mastercard, Discover, and most debit cards: 3 digits on the back, inside the signature strip.
• American Express: 4 digits on the front, above the card number.
• Cards with a worn signature panel: the code can be unreadable. The cardholder asks the issuer for a replacement.

How a test authorization works

A merchant sends the card number, expiration date, and the 3-digit code to its payment processor. The processor routes an authorization request to the issuer. The issuer returns an approval code, a decline, or a referral. A test authorization uses a small amount so the merchant can check the account without moving real money. Some processors run a $0.00 authorization that does not post to the statement.

What merchants may store

PCI DSS Requirement 3.2 bans storage of sensitive authentication data after authorization. That data includes the full magnetic stripe, the PIN block, and the 3-digit code. A merchant that keeps the code in a database after the sale is out of compliance. Many processors reject a second charge that reuses a stored code.

Why testing a card you do not own is a crime

Running a test charge on a card that belongs to someone else is card fraud, even when the amount is one dollar. In the United States, 18 U.S.C. 1029 covers access device fraud, and it applies to card numbers and codes. Buying, selling, or trading card data is a separate charge under the same statute. Federal Trade Commission data show credit card fraud is the most reported type of identity theft in the country.

Common points of confusion

• The 3-digit code is not the PIN. A PIN is 4 digits and works at an ATM or a chip terminal.
• The code is not the card number or the expiration date.
• A declined test charge does not prove a card is closed. Issuers decline on address mismatch, velocity rules, and travel flags.

Consumers can check a card status by calling the number on the back of the card or logging into the issuer app. That is the only test a cardholder needs.