CVV Test for PCI DSS: Steps and Evidence

Answer

A CVV test for PCI DSS checks two points. The card verification value is sent for authorization and the response is handled. No card verification value is stored after authorization. PCI DSS v4.0 Requirement 3.3.1 bans storage of sensitive authentication data after authorization. Run the test with sandbox test card numbers from your processor. Live card values are not valid test data.

related article

Sensitive authentication data

PCI DSS groups SAD in three parts: full track data from the magnetic stripe or chip, the card verification value, and the PIN or PIN block. CVV, CVV2, CVC2, CID, and CAV2 fall in the second group. Requirements 3.3.1 through 3.3.3 govern SAD. Requirement 3.3.1 bans storage after authorization. Requirement 3.3.2 bans storage before authorization, including encrypted storage. Requirement 3.3.3 allows storage for a card issuance or supporting service and requires the data to be rendered unreadable.

related article

Test steps

1. Collect test card numbers and their test CVC values from the processor sandbox. Sandbox cards use fixed test values. The processor documents them.
2. Submit an authorization with the matching test CVC. Record the approval response.
3. Submit the same test PAN with a mismatched CVC. Record the decline and the response code field.
4. Search application logs, database tables, queue payloads, and error reports for the three digit CVC value and for field names such as cvv2, cvc2, cav2, and cvv.
5. Review the payment page code. Confirm the CVC field posts to the processor or a processor iframe, not to a merchant server.
6. Repeat on each payment channel: e-commerce, MOTO, and card present.
7. File the scripts, raw responses, queries, and screenshots as evidence.

Expected results

• Matching CVC: approval code returned by the issuer.
• Mismatched CVC: distinct decline. Some networks return N in ISO 8583 field 39 for a CVV2 mismatch.
• Storage: zero rows and zero log entries holding the CVC after the authorization response is processed.

Evidence for a QSA or ISA

An assessor samples system components in the cardholder data environment. Useful artifacts: the test script, sandbox response logs, the database schema for payment tables, log samples, a code review note for the checkout page, and the data flow diagram. Requirement 11.3.1 covers ASV scans each quarter. Requirement 11.4.1 covers the penetration test each year.

CVV Test for PCI DSS Explanation Guide

Common failures

• CVC written to application or web server logs.
• CVC held in a session table or cache during checkout.
• CVC sent to a fraud scoring service or included in a batch export.
• Third party checkout plugin that posts the CVC to the merchant web server.
• CVC captured in a call recording for MOTO orders.

Limits

PCI DSS does not require CVV validation. Card network rules and acquirer agreements do. A CVV test does not prove PAN encryption, key management, or access control. It does not replace a penetration test or an ASV scan. Instructions that circulate in forums for buying or selling CVV data do not meet any PCI DSS test. Sandbox test values are not real card values, and real card values cannot be used for testing.