Card Verification Program: CVV2, AVS, 3-D Secure Checks

Short answer

A card verification program is a card network rule set that checks three items at the point of sale: the printed security code, the billing address, and cardholder authentication. Each check returns a response code. The issuer approves or declines the transaction. The merchant sees the codes, not the data behind them.

Ultimate Guide to Card Check Tools for Verification

The printed security code

Visa prints a 3-digit CVV2. Mastercard prints a 3-digit CVC2. American Express prints a 4-digit CID on the front of the card. Discover prints a 3-digit CID. The code is not embossed and not encoded on the magnetic stripe. The stripe carries CVV1, a separate value that terminals read during a swipe.

more on this topic

Card networks return one letter with each authorization: M for match, N for no match, P for not processed, U for unknown, S for the card should hold a code but the merchant sent none. A mismatch does not force a decline. It raises the fraud score the issuer reads.

Guide to Using a Card Verification API

Address Verification Service

AVS compares the numbers in the billing street address and the ZIP code against the issuer file. Response codes include Y (both match), A (street matches, ZIP does not), Z (ZIP matches, street does not), N (neither matches), and U (data unavailable). AVS runs in the United States, Canada, and the United Kingdom. Issuers in other markets return U or G.

3-D Secure

Visa Secure, Mastercard Identity Check, and American Express SafeKey are the authentication programs. Version 2 sends device and browser data to the issuer. The issuer picks one of three outcomes: frictionless approval, a challenge with a one-time code, or a decline. When authentication completes, fraud liability moves from the merchant to the issuer.

Storage and PCI DSS

PCI DSS Requirement 3.2 bars storage of sensitive authentication data after authorization. The list covers the full magnetic stripe, the CVV2 and CVC2 codes, and PIN blocks. A merchant can keep the authorization response code. It cannot keep the code itself, which means it cannot run the same check on a later transaction.

Card networks also issue tokens. A network token replaces the 16-digit number with a value tied to one merchant or one device. The token survives a reissue, because the network maps the token to the new account.

Trafficking in card data

Card numbers, expiration dates, and verification codes are access devices under 18 U.S.C. § 1029. Buying, selling, or transferring them is a federal crime in the United States. Penalties include fines and prison. Card networks terminate merchant accounts that store or resell verification data.