Short answer

A CVV digit test checks that the card security code is present, numeric, and the correct length, then passes it to the issuer for comparison. The issuer is the only party that can confirm a match. No public formula ties the code to the card number, so the value cannot be validated offline.

CVV Digit Examination Guide: Understanding and Protecting Your Card Information

What the test checks at the format level

  • Length: three digits for Visa, Mastercard, and Discover. Four digits for American Express.
  • Characters: digits only. No letters, spaces, or punctuation.
  • Position: Visa, Mastercard, and Discover print the code in the signature panel on the back, with the last four digits of the account number following it. American Express prints it above the card number on the front.
  • Value: the digits are not derived from the account number. The Luhn check used on a 16-digit account number does not apply to the security code.

How a merchant runs the check

  1. Present a field labeled for the security code, separate from the card number field.
  2. Accept digits only and enforce the length that matches the card brand.
  3. Transmit the value over an encrypted connection as part of the authorization request.
  4. Mark the transaction as card-not-present so the issuer knows to compare the code against its own records.
  5. Read the response code the issuer returns.
  6. Discard the code. Do not write it to a database, a log, or a receipt.

Response codes you will see

  • M: match. The code matched the issuer record.
  • N: no match. The code did not match.
  • P: not processed. The code was not sent or the issuer did not process it.
  • U: unknown. The issuer does not support the check or the data is unavailable.
  • S: the code should have been present but was not sent.

A mismatch does not always block a transaction. Many processors treat N and U as a soft decline and leave the final decision to the merchant fraud rules.

CVV Digit Verification

Why there is no offline CVV test

The issuer generates the code when the card is issued and stores it only in issuer systems. It is not reversible from the account number, the expiration date, or the cardholder name. Software that claims to calculate or verify a code without contacting an issuer is guessing. Guessing against live accounts is not a test. It is an authorization request, and issuers count failed attempts. Repeated failures on one account trigger velocity rules, block the card, and generate a fraud report.

CVV Code Test: How to Evaluate and Utilize CVV Data

Handling repeated CVV declines

  1. Confirm you requested the right code. Amex uses four digits on the front. Do not ask for a three-digit back code on an Amex card.
  2. Check the field length. A field capped at three digits rejects every Amex card.
  3. Verify the transaction is flagged as card-not-present. A keyed transaction marked as card-present can cause the issuer to skip the check.
  4. Ask the cardholder to re-enter the code. Typos cause most N responses.
  5. Route repeat failures to manual review instead of retrying the authorization.

Storage and compliance

The CVV is sensitive authentication data. PCI DSS prohibits storing it after authorization, including in encrypted form. It must not appear on receipts, in logs, in a data warehouse, or in a call recording. Merchants who keep it lose the ability to claim compliance and absorb the liability for any breach.

CVV Digit Check Guide: How to Verify Card Security

Legal limits

Running a CVV test against a card you do not own or have written permission to use is unauthorized access to a payment account. In the United States, that falls under 18 U.S.C. 1029 and carries criminal penalties. Legitimate testing happens in issuer sandboxes with test card numbers.