What CVV localization testing covers

CVV localization testing checks that a payment form accepts and validates the card security code across markets. The code is 3 digits on Visa, Mastercard, and Discover cards. It is 4 digits on American Express cards. UnionPay prints CVN2 on its cards. A test pass confirms the field takes the right digit count and shows the right label in each language.

cvv test localisation

Scope is the cardholder-facing form and the gateway response. Scope does not include storage of the code. PCI DSS forbids storing the security code after authorization.

Test CVV Localization Guide

Length and network rules

• Visa, Mastercard, Discover, UnionPay: 3 digits.
• American Express: 4 digits, printed on the front of the card.
• JCB: 3 digits.

A field locked to 3 characters rejects Amex cards. A field that takes 4 characters for Visa passes the input step and fails at the gateway with a length error. Both cases need a test entry.

more on this topic

Field attributes

• autocomplete="cc-csc", per the WHATWG autofill field list.
• inputmode="numeric", which raises the number pad on iOS and Android.
• maxlength of 4, with server-side checks against the network.
• No spaces, no dashes, no letters.

Arabic and Hebrew locales need a check on digit rendering. Some devices show Arabic-Indic numerals inside the input. The value sent to the gateway must stay ASCII.

cvv test localisation

Labels and error text

Networks use different names for the same code. Visa prints CVV2. Mastercard prints CVC2. American Express prints CID. One label for all locales confuses cardholders.

Test each localized string for width. German and Finnish labels run long and clip in narrow fields. Japanese and Korean strings need a font with kana and hangul coverage.

Error copy needs the same pass. A wrong code returns a distinct gateway response. Map that response to text per locale. Confirm the text fits the UI slot character limit.

Sandbox responses

Test gateways return set results for set card numbers. Stripe test cards return a cvc_check value of pass, fail, or unavailable. Adyen and Braintree publish similar lists. Use those numbers, not live cards. A test plan with real card numbers pulls the project into PCI DSS scope.

Test matrix

1. One locale per script: Latin, Arabic, Hebrew, Japanese, Korean, Chinese.
2. 3-digit and 4-digit networks in each locale.
3. Empty field, letters, spaces, 5 digits, and a wrong code.
4. Keyboard type and autofill on iOS and Android.
5. Gateway response code and its localized message.