A card verification number test checks that a payment page captures the 3-digit or 4-digit security code printed on a card, validates its length and format, sends it to the gateway for verification, and then discards it. The test passes when the gateway returns a match response for a correct code, a no-match or not-processed response for a bad one, and nothing about the code is written to storage.

card verification check

What Is a Card Verification Number?

The card verification number is a short code that card issuers print on the plastic but never encode in the magnetic stripe or chip. It exists to prove that the person entering the number physically holds the card, which reduces fraud in card-not-present transactions.

Card Verification Test Online: How to Buy CVV Safely

• Visa, Mastercard, Discover: 3 digits on the back, usually the last three digits in the signature panel.
• American Express: 4 digits printed on the front, above the card number on the right side.
• Other names: CVV2, CVC2, CVN2, CID, and card security code all refer to the same value.

What Does a Card Verification Number Test Check?

A complete test covers four things: input handling, transmission, the gateway response, and what the system retains afterward.

What Is a Verification Test Card? A Practical Guide

1. Input handling. The field accepts the right number of digits, rejects letters and symbols, and does not force a value the card type does not use.
2. Transmission. The code travels over TLS and is passed straight to the processor or tokenized by the payment provider.
3. Response code. The gateway returns the correct verification result, so the order is approved, declined, or flagged as configured.
4. Retention. The code is not written to the database, logs, receipts, or a session store.

How Do You Test a CVV Field in a Sandbox?

Payment providers publish sandbox card numbers that behave like real cards. In most sandboxes, any code with the correct number of digits for that brand is accepted, so 123 for a Visa test card and 1234 for an American Express test card both pass. Testing a mismatch usually means entering a short code, a long code, or a designated decline value listed in the provider documentation.

Card Verification Test Tool Buying Guide

What Do CVV Verification Response Codes Mean?

Gateways translate the issuer's answer into a single letter, and those letters matter when you read logs.

• M match, the code is correct.
• N no match, the code is wrong.
• P not processed, the issuer did not check it.
• U unknown, the issuer could not be reached or the check was unavailable.
• S the code should have been sent but was not, which often points to a configuration problem.

Why Merchants Must Not Store the Card Verification Number

PCI DSS Requirement 3.2 classifies the card verification value as sensitive authentication data and prohibits storing it after authorization, even in encrypted form. Only the verification response code may be kept for dispute evidence. A test that leaves the code in a log file or an order record is a failed test regardless of the gateway result.

Common Mistakes in Card Verification Number Testing

• Trimming leading zeros, which turns 012 into 12 and breaks length checks.
• Applying the Luhn algorithm to the security code. Luhn validates the card number, not the CVV.
• Using real card numbers from public sources instead of sandbox test numbers.
• Ignoring the S response code, which hides a broken integration.
• Caching the code in browser autofill or a session variable.

FAQ

Does every card have a card verification number?

Nearly all major cards carry one, but a few prepaid, gift, and virtual cards do not. When the field is empty and the issuer does not support verification, the gateway returns P or U rather than a match.

Can a card verification number test prove a card is valid?

No. A match confirms the code matches what the issuer has on file. It says nothing about whether the card is expired or funded, which is why authorization and address verification run alongside it.

Is testing a CVV field the same as testing a card number?

No. Card number tests cover length, the Luhn checksum, and the bank identification number. The CVV field has its own length rules, its own response codes, and its own storage prohibition.