A CVV 3 digit test verifies that the three-digit security code on the back of a Visa, Mastercard, or Discover card matches the value the card issuer has on file. The test returns a match, a mismatch, or no result. Merchants see only the response, not the code itself once the transaction is authorized.
What is the 3-digit CVV?
CVV stands for card verification value. Visa uses the term CVV2 for the printed code on the back of the card, Mastercard calls it CVC2, and American Express prints a four-digit CID on the front. The code is separate from the card number and from the PIN.
- Visa, Mastercard, Discover: 3 digits on the back, to the right of the signature strip
- American Express: 4 digits on the front, above the card number
- Purpose: show that the person entering the card number holds the physical card
How does CVV verification work?
The merchant sends the code along with the authorization request. The issuer compares it against its own record and returns a single-character response code. The code is not stored by the merchant after authorization.
Common gateway response codes include M for match, N for no match, P for not processed, U for unknown, and S when the code should have been present but was not. An N response usually causes a decline, while U and P often send the order to manual review.
CVV 3-Digit Verification Guide: Understanding the Process
How do merchants test CVV validation?
Payment providers publish sandbox card numbers and test CVC values that only work in test mode. Developers run those numbers to confirm that a checkout declines a wrong code and accepts a correct one. No live card or real code is involved in that process.
A complete test covers three paths: a match, a mismatch, and a missing code. Testing the missing-code path matters because some card types do not require a CVV for every transaction type.
What results should a test produce?
- Correct code returns an approval or an M response.
- Wrong code returns a decline or an N response.
- Blank field returns an S or a configured default, depending on the processor.
Why do legitimate CVV checks fail?
Typos, worn printing, and virtual cards that rotate codes cause most mismatches. A cardholder who recently replaced a card may enter an old code from memory. Re-entering the code from the physical card resolves most of these cases.
How should cardholders protect the 3-digit code?
Treat the CVV like a password. Never read it to an unsolicited caller, never send it by email or text, and never keep it in a notes app. PCI DSS rules forbid merchants from retaining the code after authorization, so any business that asks you to save it is a warning sign.
Frequently asked questions
Is the CVV the same as the PIN?
No. The PIN authorizes ATM and debit transactions and is entered on a keypad. The CVV is printed on the card and is used for card-not-present purchases.
Can a merchant store the 3-digit code?
No. PCI DSS prohibits storing the CVV or CVC after authorization, even in encrypted form.
Does a CVV test prove a card is valid?
No. A match only confirms the code is correct. It does not confirm the cardholder's identity or that funds are available.