What CVV verification answers

CVV verification answers one question: does the person entering the card number also hold the physical card? The card verification value is a short code printed on the card and never encoded on the magnetic stripe or the chip. A payment processor passes that code to the issuing bank inside the authorization request. The bank compares it to the value it holds on file and returns a result code. A match does not prove the transaction is safe, and a mismatch does not always block the sale, but most processors treat a mismatch as a strong signal to decline or hold the order.

related article

Prerequisites

  • A card that carries a printed verification code
  • A payment form with a dedicated CVV field
  • An authorization request configured to send that field
  • Access to processor response codes for your account

Steps to verify a CVV

  1. Locate the code on the card. On Visa, Mastercard, and Discover it is the 3 digit number printed to the right of the signature strip. On American Express it is the 4 digit number printed on the front, above the card number.
  2. Enter the card number and the expiration date into the payment form.
  3. Type the verification code into the CVV field with no spaces, dashes, or leading zeros.
  4. Submit the authorization request to the processor.
  5. Read the response code the issuer sends back.
  6. Compare that code against your processor documentation before you decide to decline or hold the order.

Response codes you will see

Processors return a single letter in the card verification field. The same letters appear across most gateways, though you should confirm the list for your own provider.

related article

  • M: match, the code entered matches the issuer record
  • N: no match, the code entered does not match
  • P: not processed, the check did not run
  • U: unknown, the issuer does not support the check for that card
  • S: the code was not sent with the request

Reasons a CVV verification fails

  • The customer typed the code from memory and transposed digits
  • The customer read the last digits of the card number instead of the printed code
  • The card was reissued and an old code is still saved in browser autofill
  • The issuer does not participate in the check for that card product
  • The charge is a recurring payment and no code was sent

Handling rules

PCI DSS classifies the CVV as sensitive authentication data. A merchant may pass the code through during authorization but must not store it once the transaction completes, and must not print it on a receipt. Writing the code to a database, a log file, or a customer record breaks the standard and removes the protection the check provides.

cvv verify guide