CVVcodes

CVV codes, also known as Card Verification Values, are security features used by payment card networks to help verify that the card is in the possession of the cardholder during transactions where the card is not present, such as online or over the phone. The codes are separate from the card number and the magnetic stripe, and are not typically stored by merchants after the transaction is authorized.

Most cards display a three-digit CVV on the back (for Visa, MasterCard, Discover) labeled CVV or CVC; American Express uses a four-digit code on the front, labeled CID or sometimes CVC. The three-digit code is often referred to as CVV2 or CVC2 in technical documentation; the four-digit AmEx code is CID.

The CVV is used during card-not-present transactions to confirm that the customer possesses the physical card. It is not a replacement for a card number or PIN and does not authorize recurring charges by itself. Payment processors and networks generally discourage storing CVV data after authorization, in line with PCI Data Security Standard requirements, to reduce fraud risk.

Security considerations: consumers should avoid sharing CVV codes beyond legitimate merchants and should avoid saving CVV data in insecure locations. Merchants are encouraged to minimize CVV storage; some jurisdictions prohibit handling or storing CVV data at all.

Limitations: CVV codes are not a foolproof security measure; compromised card numbers paired with CVV alone can enable fraud, so additional verification methods are used.

Related topics: PCI DSS, card-not-present fraud, CVC/CID terminology.