CVV Validation Example: Format Check and Response Codes

Short answer

A CVV cannot be validated by a merchant, a developer, or a third party. The card verification value is checked by the issuing bank when the authorization request reaches it. The merchant checks the format of the field, sends the value to the processor, and reads back a response code.

cvv testing sample

What the CVV is

The code is printed on the card, not encoded in the magnetic stripe, and not stored on the EMV chip. Visa, Mastercard, and Discover use 3 digits. American Express uses 4 digits and labels it the CID. The value proves the card is in hand during a card-not-present transaction.

CVV Check Example: Safe Verification for Merchants

Format check, step by step

1. Remove spaces and dashes from the input string.
2. Reject any character that is not a digit.
3. Require 3 digits for Visa, Mastercard, and Discover.
4. Require 4 digits for American Express.
5. Keep leading zeros. They are part of the code.
6. Send the value to the processor in the authorization request.

The Luhn algorithm belongs to the card number (PAN) field, not to the CVV field. Running Luhn on the CVV returns noise.

cvv check example

What the response codes mean

• M: the code matches.
• N: the code does not match.
• P: the check was not processed.
• U: the issuer does not support the check.
• S: the card should carry a code, but none was sent.

These codes come from the issuer. A site that pretends to produce them on its own is reporting a format pass, not a match.

related article

Sandbox testing

Payment processors publish test card numbers for sandbox use. Each test number carries a fixed CVV. Send that value and the sandbox returns M. Send any other value and it returns N. This is the standard way to test a checkout form without a real card.

Storage rule

PCI DSS classifies the CVV as sensitive authentication data. Requirement 3.3 bans storage of the value after authorization, in any form, including encrypted. A system that keeps CVVs in a database fails the standard and cannot pass an assessment.

Common errors

• Applying a 3 digit rule to American Express.
• Trimming leading zeros during type conversion.
• Running a Luhn check on the CVV field.
• Logging the raw value to an error file.

A field that passes a format check is not a valid card. Only the issuing bank can confirm that the code on the plastic matches the account.