CVV Length Test: 3 or 4 Digits by Card Network

A CVV length test checks whether the card verification value entered at checkout has the correct number of digits for its card network: 3 digits for Visa, Mastercard, and Discover, and 4 digits for American Express. It is a format check only, meaning it confirms the field is filled out correctly before the payment processor handles the actual authorization.

How Many Digits Each Card Network Uses

The length comes from the network that issued the card, not from the merchant or the payment gateway. You can split the rule into two groups.

• Visa (CVV2): 3 digits, printed on the back of the card to the right of the signature strip.
• Mastercard (CVC2): 3 digits, printed on the back of the card.
• Discover (CID): 3 digits, printed on the back of the card.
• American Express (CID): 4 digits, printed on the front of the card above the card number.

Why American Express Uses Four Digits

Amex places its code on the front of the card rather than the back, and it uses a four digit format. That is a network design choice, not a security upgrade. The extra digit gives the issuer more possible values, but the code still plays the same role: it proves the person entering the number is holding the physical card or has access to it.

What a CVV Length Test Actually Validates

A well built test does a few narrow things and nothing more.

1. Accepts digits only. Letters, spaces, and dashes should be rejected or stripped before validation.
2. Checks the exact count: 3 for most networks, 4 for Amex.
3. Rejects an empty field so the form does not submit a blank value.
4. Keeps the value as a string, so a code starting with a zero is not shortened to two digits.

What it cannot do is confirm that the code is real or matches the account. Only the issuing bank can answer that, and only through an authorization request.

Length Test vs. Validity Check

These two steps are often confused. The length test is local and instant. It answers one question: does this field contain the right number of digits for a card verification value? The validity check happens later, when the processor sends the code to the issuer and the issuer approves or declines the transaction. Passing the length test tells you nothing about whether the card is open or the code is correct.

Common Mistakes in CVV Format Validation

• Hardcoding 3 digits and blocking every American Express cardholder.
• Storing the code as an integer, which drops a leading zero and breaks the check.
• Trimming the field after validation instead of before, so extra spaces cause a false failure.
• Writing the code into logs, analytics, or order notes.
• Validating on the server only, which forces a round trip for a simple typo.

Rules That Apply Alongside the Test

The PCI Security Standards Council treats the card verification value as sensitive authentication data. That means it may be used to process a transaction but must not be stored after authorization, and it should never be written to a database, a log file, or a customer record. A length test belongs in the checkout form, not in a stored data set.

Quick Answer Recap

If you only need the count: 3 digits for Visa, Mastercard, and Discover, and 4 digits for American Express. Build the field to allow four characters, then apply the network specific rule at the point of validation.