Braintree CVV Validation Explained: Response Codes and Rules

Braintree CVV validation sends the card's 3- or 4-digit security code to the issuing bank with the authorization request and returns a single-letter result: M, N, U, S, P, or I. Merchants then apply CVV rules to decide whether that result should decline the transaction, let it through, or flag it for manual review.

Braintree CVV Test API Guide: How to Use It for Security

What the CVV check actually verifies

CVV is a short numeric code printed on the card but not encoded on the magnetic stripe or the chip. Visa, Mastercard, and Discover use three digits on the back; American Express uses a four-digit code on the front. Braintree accepts the value in the cvv field of the credit card object and passes it through with the authorization request.

braintree cvv validation

The issuer compares the submitted code against its own record for that account and answers with a result. Nothing about the check confirms the person using the card is the cardholder. It only confirms that whoever entered the code had access to the physical card or to data derived from it, which is why CVV is one signal among several rather than a standalone fraud verdict.

braintree cvv testing

The six CVV response codes Braintree returns

Each transaction exposes a cvvResponseCode value. The letters mean the following:

• M means the code matched the issuer's record.
• N means the code did not match.
• U means the issuer could not verify the code, often because the issuer does not support CVV checks or the verification service was unavailable.
• S means the merchant indicated the code was not present, which is the normal result for a vaulted card used in recurring billing.
• P means the processor did not process the CVV check.
• I means the code submitted was invalid or the issuer did not supply a result.

These are verification results, not declines. A transaction can return N and still be authorized if your rules allow it.

How CVV rules turn a code into a decision

CVV rules live in the Control Panel under Settings and Processing. They define which results you are willing to accept and which should trigger an automatic decline before the transaction is submitted for settlement. Typical configurations decline on N only, decline on N and I, or accept everything and route mismatches to review.

The rules are blunt by design. A strict setting catches mistyped codes but also rejects legitimate customers who transcribe a code incorrectly, so most merchants pair a moderate CVV rule with address verification and their fraud tooling rather than relying on the code alone. Transaction-level API options can bypass these rules where the integration supports it, which is useful for testing and for specific payment flows.

Where CVV validation stops working

Several common situations produce a CVV result that tells you little about fraud risk:

• Vaulted cards and subscriptions. PCI DSS forbids storing the CVV after authorization, so a stored card always returns S. Applying strict CVV rules to recurring charges will decline your best customers.
• Merchant-initiated transactions. Charges the customer did not actively trigger usually carry no code at all.
• Issuers without CVV support. Some regions and card products return U consistently, no matter what the customer types.
• Card-not-present entry errors. A transposed digit looks identical to a fraudulent attempt at the response-code level.

CVV, AVS, and the decline response are three separate signals

AVS compares the billing street address and ZIP code with the issuer's records. CVV compares the security code. The authorization response is a third thing entirely, and an issuer can approve a transaction with a CVV mismatch or decline one where the code matched. Read all three together and log the CVV result alongside the AVS result and the processor response so disputes can be traced later.

Testing CVV behavior in the sandbox

Braintree's sandbox lets you exercise each response code without touching a live card. Documented test values include 123 for a match and 200 for a mismatch, with additional values mapped to the remaining codes. Because the sandbox derives the result from the value you submit rather than from an issuer, you can verify that your decline rules, review queues, and logging all behave as intended before switching to production credentials.

Settings that reduce false declines

• Exclude vaulted and recurring charges from CVV rules, since those transactions cannot carry a code.
• Treat U differently from N. An unverifiable code is not evidence of fraud.
• Require the code field on card-not-present checkout forms and validate its length before submission.
• Store the response code with the transaction record, never the code itself.
• Combine CVV results with device data, velocity checks, and AVS before writing custom decline logic.