CVV Validation Example: Format Check and Response Codes
CVV validation runs at the issuing bank, not on your site. Format rules, response codes, sandbox testing, and the PCI DSS storage ban.
CVV Validation Sample: Format Rules and Test Values
A CVV validation sample is the set of format rules a checkout form applies to the card security code before it sends the transaction for authorization. In practice, a sample rule for most cards checks for exactly three digits, while a sample rule for American Express checks for four digits. The CVV is never stored after authorization, so validation is a format check, not a database lookup.
What Each Card Network Expects
Card security codes are not interchangeable across networks, which is why a validation sample has to branch by card type.
- Visa, Mastercard, Discover: three digits, printed on the back of the card near the signature panel.
- American Express: four digits, printed on the front, above the card number.
- UnionPay and most regional issuers: typically three digits, with a few exceptions.
The naming differs too. Visa calls it CVV2, Mastercard calls it CVC2, American Express calls it CID, and Discover calls it CID as well. All of them refer to the same printed value, and a CVV validation sample treats them the same way on the front end.
A Sample Validation Rule Set
A practical sample combines length, character class, and trimming rather than one pattern for every card.
CVV Test Example: How to Safely Validate Credit Card Details
- Strip spaces and dashes from the input.
- Reject anything that is not a digit.
- Apply
^[0-9]{3}$when the card is Visa, Mastercard, or Discover. - Apply
^[0-9]{4}$when the card is American Express. - Submit the value to the processor in the same request as the card number, then discard it.
The Luhn algorithm does not apply here. Luhn validates the primary account number, not the security code, so a CVV validation sample should never run a checksum on the CVV itself.
Sample Test Values for Sandbox Work
When developers build and test forms, they use dummy numbers from a processor's sandbox documentation. These sample values are published for testing only: 123 for a three digit field and 1234 for an Amex field. Many test suites also include 000 and 999 to confirm that the form accepts any three digit string, because a CVV cannot be verified by pattern alone. The issuing bank compares it during authorization, and the merchant only sees an approval or decline.
What Validation Cannot Do
Format validation stops typos and malformed input. It cannot confirm that a code matches a real account, and it cannot detect a stolen number. That gap is why merchants rely on address verification, 3D Secure, velocity checks, and processor fraud scoring alongside the CVV field.
Handling Card Data Legally
Card security codes are sensitive authentication data under the PCI DSS framework, and merchants are not permitted to retain them after a transaction is authorized. Buying, selling, or trading live CVV data is card fraud and is prosecuted under laws such as 18 U.S.C. § 1029. Legitimate CVV validation samples exist for one purpose: making a payment form accept the right number of digits and pass it securely to a processor.