CVV Validation

CVV validation is the check a payment processor runs against the 3- or 4-digit card verification value when a card is entered at checkout, confirming that whoever is typing the number also has physical access to the card. It happens inside the authorization request, takes well under a second, and is invisible to the customer. This guide explains how it works, what it does and does not stop, and the rules that govern handling those digits. It covers CVV validation as a payment-security practice, not the buying or selling of card numbers or verification values.

cvv validation process

Key Features

• Compares the code the customer enters with the value the issuer has on file at the moment of the transaction.
• Runs as part of standard authorization, so there is no redirect, app, or one-time code for the shopper.
• Returns a pass, fail, or unavailable result that your gateway can act on.
• Configurable response rules, from a hard decline on mismatch to a flag for manual review.
• Works alongside address verification (AVS), 3-D Secure, and velocity checks rather than replacing them.
• Supported across Visa, Mastercard, American Express, Discover, and most regional networks.
• Keeps working when the issuer is unreachable by returning an "unavailable" result instead of a false decline.

On Visa, Mastercard, and Discover cards the value is three digits printed on the signature panel; American Express prints four digits on the front. It is also known as CVV2, CVC2, or CID depending on the network. Under PCI DSS it is classified as sensitive authentication data: you may not store it after authorization, even encrypted, which is why processors expose it through hosted fields or tokenization so the raw value never touches your servers.

cvv validation method

Does CVV validation stop all card-not-present fraud?

No. It reliably blocks the common case where someone has a card number but not the card itself. It does nothing against a stolen physical card, and it can be defeated by malware that skims the value from a checkout page in real time, so it belongs in a stack of controls rather than on its own.

cvv validation algorithm

What happens when the CVV check fails?

That depends on your settings. Many merchants decline outright, while others route the order to manual review so a legitimate typo does not cost a sale. False mismatches are rare but do occur, so review thresholds are worth tuning against your own decline data.

Can a merchant ask for the CVV by phone or email?

It can be accepted over the phone for a mail-order or telephone-order transaction, but it must not be stored afterward, and call recordings that capture it must be handled per PCI DSS. Asking for it by email or chat is not acceptable practice.