CVV Format Standard: Length, Placement, and Network Rules

The CVV format standard is fixed by card network: three digits for Visa, Mastercard, and Discover, and four digits for American Express. The code is printed on the card rather than embossed, and it is not encoded in the magnetic stripe or the EMV chip, which is why it applies to card-not-present transactions only.

cvv format checking

What the CVV format standard defines

The standard sets rules for the verification value itself, separate from the rules that govern the 16-digit primary account number. Those rules cover four things:

cvv format example

• Length. Fixed per network, either three or four characters.
• Character set. Numeric digits only. Letters and symbols are rejected.
• Placement. A defined spot on the front or back of the card, depending on the issuer network.
• Storage status. The value is generated by the issuer and is not derivable from the card number.

A key detail is that the CVV format has no check digit. The account number uses the Luhn algorithm so a mistyped digit can be caught locally. The CVV carries no such self-check, so a payment gateway can only confirm that the entry is the right length and contains only digits before passing it to the issuer.

related article

Code names by network

Each network brands the same concept differently, which is why the term CVV is not universal:

• Visa: CVV2, three digits, back of card.
• Mastercard: CVC2, three digits, back of card.
• Discover: CID, three digits, back of card.
• American Express: CID, four digits, front of card.
• UnionPay: CVN2, three digits, back of card.

The card-present counterparts use similar names but different values. The code encoded on a magnetic stripe is often called CVV1 or CVC1, and the value inside an EMV chip is the iCVV or dynamic CVV. Those versions are generated from different data than the printed code, so they do not match it.

Where the printed code appears

On a three-digit card, the number sits in the signature panel on the reverse, usually to the right of the last four digits of the account number reprinted there. On a four-digit American Express card, the number is printed on the front, above and to the right of the embossed account number. The digits are flat printed, not raised, and they are not part of the account number sequence.

What the format deliberately excludes

PCI DSS classifies the CVV as sensitive authentication data and prohibits storing it after a transaction is authorized, even in encrypted form. That single rule shapes most of the format behavior people notice in practice:

• Merchants cannot retrieve a stored code to reprocess a charge.
• A subscription or recurring payment must be authorized without the CVV present.
• The code cannot be regenerated from the account number if a cardholder forgets it.
• Support agents cannot read it back from a cardholder record.

Why the format rules matter in verification

Checkout systems validate shape before value. A three-digit field rejects any entry that is shorter, longer, or non-numeric, which filters typos before an authorization request is sent and avoids unnecessary decline traffic. Passing that local check does not mean the code is correct; it only means the entry is well formed. The issuer performs the real match at authorization time.

Common misconceptions

• The CVV is the PIN. They are separate credentials. The PIN authorizes card-present and ATM use; the CVV covers remote entry.
• The CVV changes with every transaction. The printed code stays the same for the life of the card. Only certain chip-based dynamic variants rotate.
• All networks use three digits. American Express uses four.
• The code can be calculated from the card number. It cannot. It is issued separately and tied to the account at the issuer.

Legal boundary for card security codes

The CVV exists to confirm that the person entering a card number physically holds the card. Buying, selling, or trading CVV data without the cardholder's authorization is a federal offense in the United States under access device fraud statutes, and it violates card network rules regardless of where the transaction occurs. Legitimate handling of the value is limited to the cardholder, the issuing bank, and payment processors acting under a compliant agreement.