CVV Format Specification: Length, Placement, and Rules
Buy Gift Cards from Google®, Apple®, Steam® or your choice from our store. Pay securely with your preferred payment method.
A CVV format specification describes the shape of the card verification value: how many digits it holds, which characters are allowed, and where the digits sit on the card. The standard length is 3 digits for Visa, Mastercard, and Discover, and 4 digits for American Express. The field accepts numbers only, so a code such as 042 keeps its leading zero and stays three characters long.
CVV Format Standard: A Comprehensive Guide
Those rules cover almost every checkout form in the US and most of the world. The remaining detail lives in the differences between CVV1, CVV2, and iCVV, and in the way issuers build the value.
Checkout systems pick the field length from the card number. Numbers that start with 34 or 37 are American Express, so the form asks for 4 digits. The other major US networks use a 3-digit code.
Payment systems use three related codes. They share a naming pattern but live in different places and are built with different keys.
CVV1 sits in the magnetic stripe and appears during a card-present swipe or dip. It never shows up in print or on a receipt. Terminals read it from track data that the customer cannot see.
CVV2 is the printed code that shoppers type into an online form. It exists for card-not-present orders: e-commerce, phone orders, and mail order. Merchants ask for it to prove the buyer holds the physical card.
iCVV is stored in the EMV chip and read by chip terminals during a transaction. Issuers generate it with a key variant that differs from CVV1, so stripe data copied from a chip card will not validate. This is one reason cloned magstripes fail at chip-enabled terminals.
An issuer builds the code from three data points: the primary account number, the expiration date, and the service code. A hardware security module encrypts that string with a Card Verification Key, then converts the output into decimal digits. The issuer selects the 3 or 4 digits that end up on the card or in the stripe.
Each network defines its own key variant, so a Visa CVV2 cannot be checked against a Mastercard key. The key stays inside the issuer and processor systems. That is what stops anyone from computing a valid code from a card number and expiry date alone.
Auto-detecting the card type removes most entry errors. A form that expects 3 digits from an American Express customer will reject a valid card for the wrong reason.
No. In the United States, trafficking in card verification values falls under 18 U.S.C. 1029, which covers access devices and the data used to create them. A conviction can carry prison time and fines, and a site that offers CVV data for sale is evidence of the offense.
The specification itself is public knowledge, published by the card networks and used by every payment processor. Knowing the format does not grant access to the key that produces the values.
No. Visa, Mastercard, and Discover cards use 3 digits. American Express cards use 4 digits on the front of the card.
Yes. The code is a string of digits, so 007 and 0709 are valid entries. Payment forms should treat the field as text.
They describe the same idea under different network names. Visa calls it CVV2, Mastercard calls it CVC2, and Amex and Discover call it the CID.
It sits on the front, above the last digits of the card number on the right side. It is 4 digits long, unlike the 3-digit codes on the back of most other cards.
No. A wallet passes a token to the merchant, and the token format follows the underlying network rules. The customer may never see the code during that flow.
You will receive the digital voucher immediately.
All your data is transmitted with unbreakable SSL-RSA encryption.
You can give away, resell or keep the vouchers.
We are available for you 24 hours a day.
Be informed as soon as new vouchers are added or when there are discounts.