CVV Format Checking: How CVV, CVC, and CID Codes Work

CVV format checking means confirming that a card security code has the correct structure before a payment is submitted. Visa, Mastercard, and Discover use a 3 digit code printed on the back of the card, while American Express uses a 4 digit code printed on the front. A format check verifies length and numeric characters only. It never proves that a code is genuine or that the person typing it holds the card.

more on this topic

What each card network calls the code

Card networks use different names for the same security feature, which is why the field is often labeled generically as a card security code.

cvv format test tool

• Visa: CVV2, 3 digits, back of card
• Mastercard: CVC2, 3 digits, back of card
• Discover: CID, 3 digits, back of card
• American Express: CID, 4 digits, front of card

Some debit and prepaid cards follow the network brand printed on them, so the length rule follows the brand, not the card type.

related article

Where the code sits on the card

On most cards the code follows the last four digits of the card number inside the signature panel. American Express places its 4 digit code above the card number on the right side of the front. These positions matter for checkout design, since they explain why the input field should accept a variable number of digits rather than a fixed one.

What a format check can and cannot do

A format check catches ordinary data entry mistakes before the request reaches the payment processor.

• Detects non numeric input such as letters or symbols
• Detects wrong digit counts, for example 2 or 6 digits
• Removes spaces, dashes, and stray characters
• Rejects empty submissions when the field is required

What it cannot do is confirm that the code belongs to the card or that the account is active. Only the issuing bank can approve or decline a transaction, and it does so after comparing the submitted value against its own records.

Validation rules for payment forms

1. Strip spaces and punctuation before checking length.
2. Apply a 4 digit rule when the card number starts with 34 or 37, and a 3 digit rule for other major brands.
3. Keep the input numeric with a short maximum length so mobile keyboards show the number pad.
4. Use the standard autocomplete attribute for card security codes so browsers and wallets can fill it correctly.
5. Send the value only inside the authorization request, then discard it.

Storage and compliance limits

The PCI Data Security Standard classifies CVV2, CVC2, and CID values as sensitive authentication data. Merchants may not store them after authorization, even in encrypted form. That rule shapes how format checking is built: the check runs in memory, the value is passed to the processor, and nothing is written to a database, log file, or analytics event.

Why bulk code lists do not work at checkout

A random string of digits can pass a format check and still be worthless, because format and authenticity are unrelated. Card data offered for sale by third parties is generally stolen, and using it to place orders is payment fraud. Merchants that accept such transactions face chargebacks, network fines, and loss of the ability to process cards, which is a far larger cost than any short term gain.

Quick summary

CVV format checking is a front end quality control step. It confirms 3 digits for Visa, Mastercard, and Discover, and 4 digits for American Express, and nothing more. Authorization, not validation, decides whether a transaction goes through.