CVV Length Test: 3 or 4 Digits by Card Brand

A CVV is 3 digits on Visa, Mastercard, and Discover cards, and 4 digits on American Express. Every brand uses digits only, so a correct length test is a digit count and nothing more. Leading zeros are valid, which means the value must be handled as text, never as a number.

CVV length by card brand

• Visa — 3 digits, printed on the back signature panel. Brand name: CVV2.
• Mastercard — 3 digits, back panel. Brand name: CVC2.
• Discover — 3 digits, back panel. Brand name: CID.
• American Express — 4 digits, printed on the front above the card number. Brand name: CID.

Why the length differs

Each network defined its own security code format when it introduced card-not-present verification. American Express placed a 4-digit code on the front of the card, while the other networks placed a 3-digit code on the back. The length is fixed per brand and has not changed, so a 3-digit entry on an Amex card is a typo, not a variant.

How to validate CVV length in a checkout form

1. Set the input to type="text" with inputmode="numeric" so mobile users get a number keypad without losing leading zeros.
2. Set maxlength="4" and autocomplete="cc-csc" on the field.
3. Strip spaces and hyphens from the submitted value before any check.
4. Reject the value if it contains anything other than the digits 0 through 9.
5. Look up the card brand from the card number's leading digits (BIN range).
6. Require exactly 4 digits when the brand is American Express, and exactly 3 digits for all other brands.
7. Return a single generic error message for a failed length check. Do not echo back what the user typed.
8. Send the value to the payment processor and discard it. Do not write it to a database, log, or analytics event.

Common mistakes

• Declaring the field as a number input, which drops a leading zero and turns 012 into 12.
• Trimming whitespace with a method that also strips the character 0.
• Accepting 3 or 4 digits on every brand instead of branching on BIN.
• Logging the submitted value in an error tracker when validation fails.

What this test does not cover

A length check confirms format only. It says nothing about whether a card is live, funded, or belongs to the person typing. A CVV is issued to the account holder by the bank and is never sold, traded, or transferred. Buying or selling card numbers with their security codes is card fraud, and PCI DSS Requirement 3.2 forbids retaining the CVV after authorization in any case.