Braintree CVV Verification: Codes, Rules, and Failed Checks

What is Braintree CVV verification?

Braintree CVV verification compares the card security code a customer types at checkout with the code the issuing bank holds on file. Braintree sends that value inside the authorization request, and the issuer returns a single-letter result. Your account rules then decide whether to accept, flag, or decline the payment.

Braintree CVV Test API Guide: How to Use It for Security

The check adds one fraud signal to a card-not-present order. It does not prove the buyer owns the card, and it never runs on its own. Braintree returns the CVV result with the authorization response, not as a separate lookup.

braintree cvv test tool

How does the CVV check work inside an authorization?

1. The customer enters the card number, expiry date, and security code at checkout.
2. Your integration passes the code in the transaction call using the cvv field.
3. Braintree forwards it to the card network with the authorization request.
4. The issuer compares the code to its records and returns a letter code.
5. Braintree applies your CVV rule and returns the result in the response object.

Card networks use different names. Visa and Mastercard call it CVV2 or CVC2, American Express uses a 4-digit CID, and Discover uses a 3-digit CID. Braintree handles the naming, so you pass the digits the customer entered.

Braintree CVV Test Example

What do the Braintree CVV response codes mean?

Braintree returns one letter per transaction. The common set:

• M - match. The code matches the issuer record.
• N - no match. The code does not match.
• U - the issuer cannot process the check, often because the card is foreign or the issuer does not support the service.
• S - the merchant marked the code as not present (recurring billing, phone orders, or stored tokens).
• P - not processed. The check was skipped.
• I - invalid data. The code failed format checks before it reached the issuer.

Labels vary a little by processor, so read the mapping in your Braintree control panel before you build rules around a code.

How do you set CVV rules in Braintree?

Braintree lets you map each CVV response to an action: accept, decline, or flag for review. Rules live in the control panel under processing settings, and each code can hold one rule at a time.

• Decline N for physical goods shipped to a verified address, where a mismatch is a strong signal.
• Flag N for digital goods sold worldwide, so one mistyped digit does not kill a real sale.
• Flag U rather than declining it. Foreign issuers produce this code often, and a decline rule will hurt international conversion.
• Accept S for recurring charges, where no code exists by design.

Rules apply at authorization. A decline under a CVV rule is final for that attempt. A flag lets the transaction settle while marking it for later review.

What happens when a customer fails CVV verification?

A failed check triggers whatever action your rule sets. Under a decline rule, the authorization is voided and the customer sees a generic decline message at checkout. The order does not settle.

Most mismatches are not fraud. Cards get reissued, customers mistype a digit, and stored billing profiles hold old data after a replacement card arrives. Ask the buyer to re-enter the code once, then stop. Repeated retries on the same card raise velocity flags at Braintree and at the issuer.

CVV verification vs AVS: what is the difference?

AVS checks the numeric part of the billing street address and the ZIP code. CVV checks the security code printed on the card. The two results are independent, and merchants read them together.

• CVV match plus AVS match: low risk.
• CVV match plus AVS fail: often a billing address typo or a gift order.
• CVV fail plus AVS fail: high risk. Review or decline.
• CVV fail plus AVS match: often a data entry error on the code.

AVS works for US, Canadian, and UK addresses on most networks. CVV works across a wider set of issuers, which is why cross-border merchants lean on it.

Can you store a CVV or check it twice?

No. PCI DSS Requirement 3.2 forbids storing the CVV after authorization, in any form, including encrypted. Braintree's vault keeps a card token and the card number, not the security code.

That limit shapes recurring billing. A subscription charge has no code to send, so the transaction goes out with CVV marked as not present and returns an S. A rule that declines S will break every subscription on the account.

Frequently asked questions

Is CVV verification mandatory on Braintree?

No. You can process a card-not-present payment without a code, and the response comes back as S or P. Skipping the check removes a useful fraud signal, and most card networks treat the field as expected for online orders.

Does Braintree charge extra for CVV verification?

No separate fee exists. The check rides along with the authorization and is covered by the standard transaction rate.

Can a payment pass CVV and still be fraud?

Yes. A stolen card and a stolen code travel together in many breaches, and a fraudster who holds both will pass the check. CVV verifies data, not identity.

Why does a valid card return a U code?

Issuers outside the US, prepaid programs, and some card products do not support the service. The code means the check could not run, not that the card is bad.

How do I test CVV responses in the sandbox?

Braintree's sandbox returns preset CVV results for specific test amounts and test card numbers. Use the testing reference in the developer docs to trigger each letter. Live cards will not reproduce those results.