CVV Validation Example: Format Check and Response Codes
CVV validation runs at the issuing bank, not on your site. Format rules, response codes, sandbox testing, and the PCI DSS storage ban.
CVV Verification Case: How Card Security Code Checks Work
What is a CVV verification case?
A CVV verification case is a single card-not-present transaction in which the payment processor asks the issuing bank to compare the card's 3- or 4-digit security code against its records and return a result. The result is a match, a mismatch, or an unavailable status. It is a fraud filter for one transaction, not proof that the cardholder is legitimate.
CVV stands for card verification value. Visa calls it CVV2, Mastercard uses CVC2, American Express uses CID, and Discover uses a card identification number. All of them serve the same purpose at checkout.
CVV Check Example: How to Safely Validate Credit Card Information
How does CVV verification work during a transaction?
- The customer submits the card number, expiration date, and security code.
- The processor sends an authorization request to the issuer with the code attached.
- The issuer compares the submitted code to the value on file for that account.
- The issuer returns an authorization response plus a separate CVV result code.
Authorization and CVV verification are two distinct checks. A card can be approved even when the CVV result comes back unavailable, because not every issuer participates in the check. Merchants should treat the CVV result as one signal among several.
What do CVV response codes mean?
- M, Match. The code matches the issuer's record.
- N, No match. The code is wrong, which is a strong fraud indicator.
- P, Not processed. The issuer does not participate in the check.
- S, Should have been present. The card is supposed to carry a code, but none was submitted.
- U, Unavailable. The issuer cannot verify the code at this time.
Why does a CVV verification case affect chargebacks?
Card network rules can shift fraud chargeback liability to the issuer when a merchant obtains a CVV match on an eligible transaction. Merchants that skip the check often absorb the loss themselves. The exact protection depends on the network, the card type, and the transaction details.
A CVV match alone does not block a chargeback for goods never received or for a dissatisfied customer. It only addresses the unauthorized-use category.
What are the rules for storing CVV data?
PCI DSS Requirement 3.2 prohibits storing sensitive authentication data after authorization, and that includes the CVV. The code may not be written to a database, log file, receipt, or customer record, even in encrypted form. A merchant that keeps CVV data is out of compliance and faces fines plus lost processing privileges.
Card vaults and tokenization solve the storage problem by replacing the card number with a token. The CVV is used once and discarded.
What should a merchant do when the CVV does not match?
Best practice is to decline the order and ask the customer for another payment method. One re-entry attempt is normal when a shopper mistypes, but repeated attempts on the same card are a fraud signal. Excessive mismatches can also trigger monitoring programs that raise processing costs.
Is CVV verification the same as 3-D Secure?
No. CVV verification is a data check performed by the issuer during authorization. 3-D Secure adds an authentication step, such as a one-time password or a banking app approval, in which the cardholder proves control of the account. The two controls are complementary.
For most online merchants, the practical rule is simple: collect the CVV, verify it, act on the result, and never store it.