CVV Verification Test: What M, N, P, S, and U Codes Mean

Short answer

A CVV verification test is an authorization request that includes the card's 3 or 4 digit security code. The issuer compares that code to its own record. The response is one of five codes: M (match), N (no match), P (not processed), S (should have been present), or U (issuer unable to process). A match confirms the code. It does not confirm the buyer owns the card.

What the code is

Visa, Mastercard, and Discover print 3 digits on the back of the card. American Express prints 4 digits on the front. The industry names are Card Verification Value 2 (CVV2), Card Verification Code 2 (CVC2), and Card Identification Number (CID).

CVV1 is a different value. It sits in the magnetic stripe and is read at a terminal. Online merchants cannot read CVV1. They use CVV2.

How the test runs

The merchant sends the code in the authorization message. The issuer returns a result code in the response. Most processors return the code in the same response as the approval or decline.

• M: the code matched.
• N: the code did not match.
• P: the issuer did not process the check.
• S: the code should have been on the card but was not sent.
• U: the issuer could not run the check.

Test authorizations

Some merchants run a $0 or $1 authorization to confirm a card is open before a subscription or a large charge. Processors set their own rules. Stripe allows a $1 authorization hold and a void. A $0 authorization fails at some issuers. The hold drops off in 1 to 8 business days.

What the test does not prove

A match means the code was correct at the time of the request. A thief who copied the card number and code from a data breach can pass the test. The test does not check the cardholder name, the billing address, or the device. 3D Secure adds a password or a one-time code from the issuer. That step ties the request to an authenticated session.

Legal note

Buying or selling card numbers and CVV codes is a federal crime in the US. 18 U.S.C. § 1029 covers trafficking in access devices. Penalties include up to 10 years in prison and fines. Testing stolen cards to find live ones is charged under the same statute.