CVV Format Validation: Digit Length and Character Rules

CVV format validation in short

A card verification value is a fixed-length numeric code. Format validation confirms the submitted field contains digits only and matches the length expected for the card network. Visa, Mastercard, and Discover use three digits. American Express uses four. There is no checksum step, no Luhn pass, and no way to confirm the code is genuine without an authorization request to the issuer.

cvv format verification

Length and character rules by network

• Visa: 3 digits, printed on the back of the card, labeled CVV2
• Mastercard: 3 digits, printed on the back, labeled CVC2
• Discover: 3 digits, printed on the back, labeled CID
• American Express: 4 digits, printed on the front above the card number, labeled CID
• UnionPay: 3 digits on the back for the large majority of cards

Step-by-step validation procedure

1. Strip leading and trailing whitespace from the submitted value.
2. Reject the value if it contains any character outside the range 0 through 9.
3. Read the card network from the card number field or from the network metadata returned by the processor.
4. Set the expected length to 4 when the network is American Express.
5. Set the expected length to 3 for every other network.
6. Compare the digit count against the expected length and reject on mismatch.
7. Reject an empty value unless the network marks the field as optional.
8. Pass the raw digits to the processor without writing them to a log, cache, or database.

Handling an unknown network at validation time

When the network is not yet resolved, a permissive rule covers the common cases: three or four digits, anchored at both ends of the string. A pattern such as a start anchor, the character class 0-9, a quantifier of 3 to 4, and an end anchor does the job. Tighten the rule once the network is known so a three-digit card is not accepted with a four-digit value. Reject any input that arrives with spaces, hyphens, or letters rather than normalizing it silently.

CVV Format Standard: A Comprehensive Guide

What format validation cannot do

Format validation only confirms that a value looks like a verification code. It does not prove the code belongs to the card, does not prove the card is open, and does not detect a guessed or generated value. Only an authorization request through an acquirer returns a definitive answer, and the issuer replies with a match or no-match result without exposing the stored code.

CVV Format Guide: The Ultimate Guide to CVV Numbers

Common implementation mistakes

• Running the Luhn algorithm on the verification code. Luhn applies to the primary account number, not to the code.
• Hard-coding a three-digit limit, which rejects American Express cards at checkout.
• Storing the value in a database, log file, or analytics event after the authorization completes.
• Using the code as a customer identifier or deduplication key across orders.

Compliance note

PCI DSS classifies the verification code as sensitive authentication data. It may be used to process a single transaction and must not be retained after authorization, even in encrypted form. Format checks belong in the request path, not in a saved copy of the value.