CVV Validation: How Card Security Codes Are Checked

What CVV validation is

CVV validation is an authorization check. The merchant sends the card security code with the payment request. The issuer compares that code against its own record for the account. The issuer returns a result: match, no match, or not processed. The check runs during authorization, before the transaction settles.

The two code types

• CVV2, CVC2, or CID: a 3-digit code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front.
• CVV1 or iCVV: a value encoded in the magnetic stripe or the chip. It is not printed. Terminals read it during a card-present transaction.

Online and phone orders use CVV2. Card-present terminals use CVV1. The two values are separate and come from different data on the card.

How the check runs

The gateway passes the code to the issuer inside the authorization message. The issuer validates the value against its record for that account. The response comes back with the authorization result. Visa publishes these CVV2 response codes:

• M: match
• N: no match
• P: not processed
• S: code should have been present
• U: issuer unable to process
• I: invalid

What a mismatch means

A no-match response means the code entered does not match the issuer record. A merchant can decline the transaction. Some merchants accept it and carry the fraud liability. For card-not-present orders, a matching code moves fraud liability to the issuer when the merchant follows network rules.

What CVV validation does not do

• It does not confirm that the person using the card is the account holder.
• It does not verify the billing address, the cardholder name, or available funds.
• It does not stop all fraud. A stolen card and its printed code still pass.

PCI DSS rules

CVV2 is sensitive authentication data under PCI DSS. Requirement 3.2 prohibits storage of sensitive authentication data after authorization, even when encrypted. A system that keeps the code in order records, logs, or databases is out of compliance. Merchants that store the code after a transaction face fines and loss of card processing. Retention of the code is also a target in data breaches.

Common errors

• Storing the code in a customer profile for repeat orders.
• Writing the code into application logs or support tickets.
• Asking the customer for the code again after a decline to force a match.
• Retrying the same order with a changed code.

Each of these violates card network rules and can trigger fines or account termination.