Braintree CVV Verification Guide: Response Codes Explained

Braintree CVV verification is a real-time check of the 3-digit security code printed on the back of a Visa, Mastercard, or Discover card, or the 4-digit code on the front of an American Express, against the value the issuing bank holds on file. Braintree passes the code inside the authorization request and returns a one-letter CVV response code, such as M for a match or N for a mismatch, in the transaction result. The code alone does not approve or block a charge; the merchant decides which response codes to decline through rules configured in the Braintree Control Panel.

more on this topic

How does Braintree CVV verification work?

The customer's security code travels with the card number, expiration date, and amount when the transaction is submitted through Braintree's API or a hosted integration. The card network routes the value to the issuer, which compares it with the CVV, CVC2, or CID it generated when the card was issued. The issuer sends back a single-character result, and Braintree surfaces that character in the response object so the merchant's system can act on it.

braintree cvv validation

Because the check happens during authorization, the result arrives in the same response cycle as the authorization outcome. No separate call is required, and no additional fee is normally assessed for the CVV check itself.

braintree cvv test tool

What do the Braintree CVV response codes mean?

Braintree returns one of a small set of letters in the CVV response field. Exact availability can vary by processor and API version, but the common values are:

• M - CVV matches the value on file with the issuer.
• N - CVV does not match the value on file.
• U - CVV not verified, usually because the issuer or card does not participate in the service.
• S - the issuer indicates the CVV should have been present on the request but it was not supplied.
• I - CVV was not provided by the merchant.
• P - CVV was not processed for the transaction.

An empty or absent value typically means the field was not returned at all and should be treated as unverified rather than as a failure.

How do CVV rules work in the Braintree Control Panel?

Braintree lets merchants build rules that trigger on the CVV response code, the AVS response code, or a combination of both. A common configuration declines the transaction when CVV returns N, and either declines or flags the transaction when the code is U, S, or I. Rules can also be set to accept and review, which routes the transaction to manual inspection instead of an automatic decline.

Rules run after the authorization response returns, so they operate on data Braintree already has. Testing a rule set in the sandbox before enabling it in production prevents accidental declines of legitimate orders.

What is the difference between CVV and AVS?

AVS verifies the numeric portion of the billing street address and the billing ZIP code against the issuer's records. CVV verifies only the printed security code. They draw on different data, so a transaction can pass one check and fail the other, and merchants generally weigh both signals together rather than treating either as decisive.

Why is the CVV never stored after authorization?

CVV data belongs to the category PCI DSS calls sensitive authentication data, which cannot be retained after a transaction is authorized. Braintree does not allow the security code to be saved in its vault, and any integration that attempts to persist the value in a local database falls outside PCI DSS scope.

This is why recurring billing and stored-credential charges run without a CVV present. Those transactions typically come back with I or an empty value, and the merchant relies on the initial verification plus the token instead.

What should a merchant do when CVV returns U or S?

A U result is neutral rather than negative. Many issuers outside the United States do not support CVV verification, so declining every U response can reject a large share of legitimate cross-border orders. A better practice is to combine U with AVS, 3D Secure, device fingerprinting, and order velocity checks.

An S result usually points to an integration problem rather than a customer problem, because it means the field was expected but missing from the request. Reviewing the API payload, hosted page configuration, and any middleware that strips fields before submission resolves most S responses.

Can CVV verification stop all card fraud?

No. CVV verification is one signal among several, and it only confirms that whoever submitted the order had access to the printed code at that moment. Merchants get stronger protection by layering AVS, 3D Secure authentication, and fraud tools such as Braintree's own risk rules on top of the CVV check.