Short answer

A four-digit CVV is an American Express code. Amex prints a four-digit Card Identification Number, shortened to CID, on the front of the card, above and to the right of the main account number. Visa, Mastercard, and Discover all use three digits: Visa says CVV2, Mastercard says CVC2, Discover says CID, and those three sit on the back near the signature strip. No card network has ever issued a "v4" code. The "v4" in a phrase like "cvv 4 digit test v4" is a file version number, the kind people stick on shared lists and script bundles, not a term from any payment specification.

related article

Why the digit count changes by network

Each network designed its own verification field, and the designs never got harmonized. What you get depends entirely on the issuer of the card:

read more

• American Express: four digits, front of card, called CID.
• Visa: three digits, back of card, called CVV2.
• Mastercard: three digits, back of card, called CVC2.
• Discover: three digits, back of card, also called CID.

The code is printed flat, never embossed, so a card imprint or a rubbing does not capture it. That was the whole point when the networks introduced these fields in the late 1990s: prove the person typing has the physical card, not just a number copied from a receipt.

cvv 4 digit test v3

How the check works at checkout

The code does not get stored by the merchant. It rides along with the authorization request, the issuer compares it against what it has on file, and a result comes back. Stripe maps those results to pass, fail, unavailable, and unchecked. Unchecked shows up more than people expect, usually because the merchant never turned the field on, or because a recurring charge runs without the customer present. A pass tells you the issuer matched the digits on one attempt. It tells you nothing about whether the account is funded, open, or belongs to the person submitting it.

related article

What "test v4" files usually are

When a file or a page carries a name like that, it is almost always a list of real card numbers with version numbering attached, passed around and relabeled as a "test" set. Calling it a test does not change what it is. In the US, trafficking in and using card account numbers falls under 18 U.S.C. 1029, which covers unauthorized access devices, and prosecutions under it are routine. Practically speaking, the numbers in those lists are usually dead within days, since issuers retire accounts tied to reported fraud.

If you are testing a checkout for real

Use the sandbox card numbers your processor publishes. They are fake, they are documented, and they let you simulate an Amex transaction with a made-up four-digit CID, a CVV mismatch decline, an unavailable response, and an unchecked response. Every major processor lists them in the testing section of its docs. That covers the engineering work without touching a live account, and it keeps your test logs out of scope for PCI audits.

The part merchants get wrong

PCI DSS treats the verification code as sensitive authentication data that must not be retained after authorization. If your order database has a column holding three or four digits, that is a finding, not a feature. Plenty of older carts did exactly that, and cleaning it up means purging history, not just changing the form. So if you are auditing a checkout, look at what gets written to the database, and confirm the code is dropped the moment the authorization response lands.