Short answer

There is no CVV digit test you can run yourself. The code is 3 digits on most cards and 4 on American Express. It is printed on the plastic, it is not encoded in the card number, and no formula derives it from the 16 digits on the front. The only place a CVV gets tested is inside a live authorization request that a merchant sends to the issuing bank through a payment processor. Anything online calling itself a CVV checker, tester, or card validator is either a phishing page that collects whatever you type or a carding tool. Using one on a card you do not own is fraud under 18 U.S.C. 1029 and comparable laws elsewhere.

What the CVV actually is

Visa, Mastercard, and Discover print a 3-digit value on the back, usually inside the signature strip. American Express prints a 4-digit code on the front above the account number. Issuers call it CVV2, CVC2, CVV, or CID depending on the network, but the purpose is identical everywhere: it shows the person typing has the physical card in hand, not just a number copied off a receipt.

Why you cannot calculate it

The issuer generates the CVV when the card is made, using a secret key that never leaves the bank, combined with the account number and often the expiry date. That means there is no checksum, no visible pattern, and no shortcut. Tools that claim to predict a CVV are guessing, and issuers shut a card down after a few wrong attempts. A string of failed tries also flags the account.

What Luhn gets confused with

The Luhn algorithm, sometimes called the mod 10 check, validates the card number itself. It exists to catch typos and mistyped digits, nothing more. It says nothing about the CVV, the expiry date, or whether the account is open. People mix the two up because both involve digits printed on a card, but they answer different questions.

Luhn in one paragraph

Working from the right, double every second digit. If a result is greater than 9, subtract 9. Add everything up and check whether the total divides by 10. A card number that passes Luhn is formatted correctly. The code on the back is untouched by any of it.

Why card checker sites are a trap

These pages ask for a full card number, expiry, and CVV, then return approved or declined. Some are phishing forms that sell the details you enter. Others are fake result generators built to sell subscriptions to people who think they are buying stolen data. Both paths end the same way: your own information in someone else's hands, or a criminal charge. I would treat any site that asks you to test a CVV as hostile by default.

How legitimate CVV validation works

At a real checkout, the merchant sends the card number, expiry, CVV, and amount to a processor. The processor routes an authorization request to the issuer. The issuer replies with an approval code plus a CVV response code, such as match, no match, or not processed. The merchant sees a yes or no and never stores the code, because PCI DSS forbids keeping it after authorization. There is no way to re-test it later, and no database you can query.

Protecting your own CVV

• Treat the code like a password. Anyone with your number, expiry, and CVV can spend on the card online.
• Never type it into a site that promises to check or validate cards.
• Use a virtual card number from your bank for unfamiliar merchants.
• If someone asks for the CVV by email or chat, it is a scam. No real processor works that way.