CVV Format Verification: Rules by Card Network

CVV format verification is the check that confirms a card security code matches the length and character rules of its payment network before an authorization request goes out. Visa, Mastercard, and Discover codes hold three digits. American Express codes hold four. The check reads shape only, so a code that passes can still belong to an expired, canceled, or stolen account.

cvv format checking

What does a valid CVV format look like on each network?

Each network decides the length of its code and the side of the card it prints on. A format check reads the length, confirms every character is a digit, and rejects everything else.

CVV Format Standard: A Comprehensive Guide

• Visa (CVV2): three digits on the back, inside the signature strip.
• Mastercard (CVC2): three digits on the back, inside the signature strip.
• Discover (CID): three digits on the back, after the account number.
• American Express (CID): four digits on the front, above the account number.
• UnionPay and some regional issuers: three digits, with older cards that carry no code at all.

Prepaid and virtual cards sometimes ship with no printed code, which blocks online use for that card. A missing field fails format verification, but it is not proof of fraud.

more on this topic

How does a merchant run a CVV check?

The checkout page collects the code, the account number, and the expiration date, then sends all three to the payment processor inside the authorization message. The issuer compares the submitted digits against the value it generated at card issue. The processor returns one of three response codes.

1. Match (M): the digits are correct.
2. No match (N): the digits are wrong.
3. Not processed (P): the issuer or the processor skipped the check.

The code travels in a private data field of the ISO 8583 message, not in the main account field, so a gateway can drop it without breaking the request. PCI DSS Requirement 3.2 bans storing the printed code after authorization, even in encrypted form. That ban is why a merchant can verify a code once and never again.

CVV, CVV2, CVC, CID: does the name matter?

The names describe the same idea with different branding. CVV1 lives on the magnetic stripe, gets read by a swipe or dip, and never reaches the customer. CVV2, CVC2, and CID are the printed versions a buyer types into a web form. Networks pick their own letters, so a CVC and a CVV are the same field.

Does the Luhn algorithm apply to CVV codes?

No. Luhn is a checksum for the primary account number, the 15 or 16 digit string embossed on the front of the card. A CVV2 value comes from a different route: the issuer feeds the account number, expiration date, and a secret key into a cryptographic function, then stores the result. No public formula lets a merchant confirm a code offline, and the three or four digits contain no checksum bit.

That gap shapes verification design. You can validate an account number offline with Luhn, but the security code can only be confirmed by the issuer in a live authorization.

What makes a CVV format check fail?

• Wrong digit count, such as three digits entered for an American Express card.
• Letters, spaces, or symbols typed into the field.
• A card product that ships with no printed code.
• A code that is well formed but does not match the issuer record (a value error, not a format error).
• A processor that routes the request without the security code, which returns 'not processed.'

What happens to the CVV check with digital wallets and tokens?

Apple Pay, Google Pay, and network tokens swap the account number for a token and replace the code with a cryptogram. The merchant never sees digits, so a format check has nothing to read. The token service and the issuer handle authentication inside the transaction.

Does a CVV check change the fee or the liability?

Card networks price an authorization on transaction type and interchange category, not on whether a code was submitted. Liability rules are different. Many chargeback programs side with the issuer when a merchant never asked for the code, so skipping the field costs more in disputes than it saves.

Why format verification alone does not stop fraud

A format check confirms that the digits look right, nothing more. It cannot tell who typed them. Buyers and sellers of stolen card data depend on codes that pass both format and issuer checks, which is why the trade falls under 18 U.S.C. § 1029 and similar laws in most countries. Merchants stack address verification (AVS) and 3-D Secure on top of the CVV step for that reason.

Frequently asked questions

Is a 4-digit CVV valid?

Only on American Express and a small set of Amex-issued products. A four digit code on a Visa, Mastercard, or Discover card fails format verification.

Where do I find the CVV on a Visa card?

On the back, inside the signature panel, as the last three digits after the full card number. Some Visa cards print the code before the card number instead. Either way, you enter three digits.

Can a CVV be 000?

Yes. Three zeros meet the length and character rules, and issuers do generate codes with leading or repeated zeros.

Do online stores store my CVV?

No. PCI DSS forbids storing the printed code after the authorization response comes back. Subscription billing uses a token or a stored account number instead.

Why does a correct CVV still get declined?

The code can be right while the account is closed, over its limit, or flagged by the issuer. A CVV match clears one of several checks in the authorization chain, not all of them.