What is CVV verification at checkout?

CVV verification at checkout is the check a merchant runs against the 3 or 4 digit security code printed on a payment card. The merchant sends the code to the card issuer, the issuer compares it with the value on file, and the payment is approved or declined based on that match. The check confirms the buyer holds the physical card, not just the card number.

more on this topic

How the check runs in a payment flow

1. The customer types the card number, expiration date, and security code into the checkout form.
2. The payment processor encrypts the data and routes an authorization request through the card network.
3. The issuer compares the submitted code with the value it holds and returns a response code.
4. The processor passes the result back to the merchant: approval, decline, or a referral for extra review.

Most processors tag the result with a flag such as CVC match, CVC mismatch, or CVC not checked. A merchant can set rules to refuse any order where the code does not match.

more on this topic

What each code is called

• Visa: CVV2, three digits on the back of the card.
• Mastercard: CVC2, three digits on the back.
• American Express: CID, four digits on the front, above the card number.
• Discover: CID, three digits on the back.

CVV1 is a different value. It lives on the magnetic stripe and is read by a terminal during a card-present purchase. CVV2 is the printed number used for online and phone orders, and the two are generated with different keys.

Checkout Card Verification Guide: How to Buy CVV

Why a CVV check fails

• Transposed or mistyped digits at checkout.
• The cardholder entered a PIN, a ZIP code, or the wrong three digits.
• The card was replaced and the number or code changed.
• The issuer does not support the check for that card type or region.
• The merchant sent the code in the wrong field, such as a four-digit Amex CID in a three-digit slot.

A mismatch ranks among the strongest fraud signals in card payments. Issuers weigh it more than an address mismatch, and many decline the transaction outright.

checkout cvv check

PCI DSS rules for the security code

The security code counts as sensitive authentication data under PCI DSS. Requirement 3.2 bars storage of that data after authorization in any form, including databases, logs, spreadsheets, and email. A merchant that keeps CVV2 data can lose the right to accept cards and faces fines from its acquiring bank.

Collection is allowed for a single sale. Storage is not. Hand the code to the processor and drop it from the order record.

How CVV, AVS, and 3D Secure differ

Each tool checks a different thing, and none of them covers the others.

• CVV proves the buyer holds the card.
• AVS compares the billing address and ZIP code with issuer records.
• 3D Secure sends the buyer to the issuer for a password, a one-time code, or an app approval.

Run together, they cut chargebacks from stolen numbers. Run alone, each leaves a gap a fraud ring can walk through.

Card testing attacks at checkout

Fraud rings test card numbers by pushing many attempts through a checkout page with small amounts. A CVV mismatch tells them the number is dead. An approval tells them the card works, and the ring then resells it or buys goods.

Watch for a spike in declines, many orders from one IP address, and a run of low-value purchases inside a few minutes. Those three signs point to card testing on a live payment form.

How to cut CVV failures and checkout fraud

• Label the field the way shoppers expect ("Security code") and show where it sits on the card.
• Cap attempts per card, IP, and device to slow automated testing.
• Block orders when the CVV result comes back as not checked on high-risk sales.
• Turn on 3D Secure for high-value or cross-border orders.
• Never log or store the code. Pass it straight to the processor and discard it.
• Give customers a clear retry path after a mismatch, since typos cause most declines.

Frequently asked questions

Does a CVV check stop all fraud?

No. A stolen card number with the code copied from the same card passes the check. The code raises the cost of fraud and blocks bulk attacks built on leaked number lists, but it does not verify the identity of the person paying.

Can a merchant ask for the security code by phone?

Yes, for a single order. PCI DSS allows merchants to collect the code during a phone sale as long as nobody writes it down and no system stores it afterward.

What does the customer see after a decline?

Banks often show a generic message, while the merchant sees a specific reason code such as CVC mismatch. Asking the buyer to recheck the digits on the card and try again is the practical step.

Why does some checkout software return "CVV not supported"?

Some issuers and regions do not support the check, and certain prepaid or virtual cards return no value at all. In those cases a merchant falls back on AVS, 3D Secure, and order screening to cover the risk.