CVV Verification Scenario: Codes, Results, and Rules

CVV verification scenario: short answer

A CVV verification scenario is the step in card authorization where the merchant sends the card security code to the issuer and the issuer returns a result code. The result is one of: match, no match, not processed, not supported, or missing. The merchant payment system then applies its own rule, such as decline the order or hold it for review.

cvv testing scenario

What the code is and where it sits

• Visa, Mastercard, Discover: 3 digits printed on the back, near the signature panel. Visa calls it CVV2. Mastercard calls it CVC2.
• American Express: 4 digits printed on the front, above the card number. Amex calls it CID.
• The code is printed, not embossed. It is not in the magnetic stripe and not in the chip.

What the issuer sends back

Visa and Mastercard use the same single-letter codes in the authorization response.

more on this topic

• M: match
• N: no match
• P: not processed
• U: not supported or unknown, the issuer does not take part
• S: the code should have been on the request but was not

An N result is a data point, not an automatic decline. The issuer sets its own response. The merchant sets its own rule. Many card-not-present merchants decline on N. Others send the order to manual review. U and P give the merchant no signal at all.

cvv test plan

What the check does not do

The CVV check does not prove the person at the keyboard is the cardholder. It shows that the person had the printed card or a copy of the number. Card-not-present fraud still happens when a code is captured along with the account number. Result codes carry no data about the cardholder name, address, or intent.

Storage rules

PCI DSS bars storage of the card security code after authorization. The rule covers the code and any data derived from it. Merchants may pass it during the authorization message and may not keep it afterward. A system that stores it fails the assessment.

Legal status in the United States

Buying, selling, transferring, or possessing card numbers and security codes taken from another person is a federal crime under 18 U.S.C. 1029. The statute covers counterfeit access devices and unauthorized access devices. Most first offenses carry a statutory maximum of 10 years in prison and a fine. Card networks also bar merchants from selling card data. There is no legal market for CVV data.

Common decline text tied to the check

• Visa: CVV2 failure, or response code 05 with a CVV note.
• Mastercard: CVC2 mismatch.
• Gateway wording: invalid security code, or card verification failed.

Gateway wording varies by processor. The letter code in the issuer response is the source data. The message invalid security code is often produced by the merchant system before any issuer check, in the case of a malformed entry such as two digits instead of three.

Where the scenario shows up in practice

Recurring billing runs a stored account number with no code, so the code field is absent and the issuer returns S or U. Manual keyed orders run the code when an agent reads it to a customer. E-commerce checkout collects it in the payment form. Each path produces a different mix of result codes, and the decline rate moves with it.