CVV Format Specification: Length and Placement Rules

A CVV format specification defines how many digits the card verification value contains and where it is printed on a payment card. Most card networks use a 3-digit code on the back of the card, while American Express uses a 4-digit code on the front. The value is not encoded on the magnetic stripe or the EMV chip, and card industry rules forbid storing it after a transaction is authorized.

cvv format test tool

What the format actually defines

The specification is narrow. It covers the digit count, the character set, the physical location on the card, and the naming convention each network uses. It does not define how the value is generated, which happens inside the issuing bank's systems, and it does not describe how a merchant should handle the value beyond the storage prohibition.

CVV Format Guide: The Ultimate Guide to CVV Numbers

• Length: 3 digits for Visa, Mastercard, Discover, and UnionPay; 4 digits for American Express
• Character set: numeric only, with no letters, spaces, or symbols
• Placement: back signature panel for most networks, front face for American Express
• Network names: CVV2, CVC2, CID, and CVN2 all refer to the same concept

Network-by-network breakdown

• Visa uses CVV2, a 3-digit value printed in the signature panel on the back.
• Mastercard uses CVC2, also 3 digits, in the signature panel on the back.
• Discover uses CID, 3 digits, printed on the back of the card.
• American Express uses CID, 4 digits, printed on the front above the card number.
• UnionPay uses CVN2, 3 digits, on the back of the card.

A CVV format specification for one network does not carry over to another. A four-digit field will not validate an Amex card, and a three-digit field will not validate an Amex card either.

Understanding the CVV Format Example: A Guide for Users

Where the code sits on the card

On Visa, Mastercard, Discover, and UnionPay cards, the value follows the last four digits of the card number inside the signature strip. On American Express cards, it sits just above the embossed card number on the right side of the front face. The placement matters for manual entry, since a person reading the card needs to know which panel to check.

Why the format matters for security

The Payment Card Industry Data Security Standard treats the card verification value as sensitive authentication data. Merchants may pass it to the processor to complete a transaction, but they may not retain it afterward in any form. That single rule shapes most checkout systems: the value moves through the payment page to the gateway and is discarded, while the card number may be tokenized and stored for repeat billing.

Because the code is not written to the magnetic stripe or the chip, a card that is physically skimmed at a terminal does not expose it. That is why card-not-present fraud checks lean on the value as one signal among several, alongside address verification and 3-D Secure authentication.

Common mix-ups

• A PIN is not a CVV. The PIN authorizes a card at an ATM or terminal and is entered by the cardholder.
• AVS data, such as a billing ZIP code, is a separate verification method with its own rules.
• The full card number is not part of the CVV format. They are separate fields with separate handling rules.
• Card networks use different names for the same code, which leads to confusion in documentation and support tickets.

Quick reference

Three digits, back of card, numeric only: Visa, Mastercard, Discover, UnionPay. Four digits, front of card, numeric only: American Express. Never stored after authorization under PCI DSS, regardless of network. Any system that accepts card payments should validate the field length against the detected network before submitting the transaction, then drop the value once the response comes back.