What is the tokenization CVV process?

Tokenization swaps a card's primary account number (PAN) for a random surrogate value called a token. The CVV is not tokenized. It travels with the authorization request once, gets checked by the issuer, and is then deleted, so no token ever carries a CVV forward.

CVV Tokenization Algorithms: A Comprehensive Guide to Purchasing CVVs Securely

That split matters. A PAN can sit in a token vault for years and still be safe to reuse. The three or four digit code on the card cannot be stored by anyone in the payment chain except the issuer.

CVV Tokenization Tool Guide: Where to Buy CVV

What is the difference between a PAN and a CVV?

The PAN is the long number printed on the card. The CVV is the short code that proves the person using the PAN holds the physical card.

tokenization cvv test

• PAN (primary account number): identifies the account. Merchants tokenize it, store tokens, and reuse them for later charges.
• CVV, CVC, CVV2, CID: the same idea under different network names. Visa uses CVV2, Mastercard uses CVC2, American Express and Discover use CID.
• Track data and PINs: also classified as sensitive authentication data, and also barred from storage after authorization.

Names vary by brand. The rule does not: the code is single use.

tokenization cvv process

How does the CVV move through a card-not-present transaction?

1. The customer enters the PAN, the expiry date, and the CVV into a checkout form or a hosted payment page.
2. The gateway encrypts the data and sends an authorization request to the issuer.
3. The issuer compares the CVV against the value it generated for that card. A mismatch returns a decline or a CVV failure code.
4. The issuer approves or declines, and the gateway passes the response back to the merchant.
5. The merchant gets an authorization code. The gateway or processor stores a token that points at the PAN. The CVV is dropped at the end of the authorization step.

Settlement runs later and uses the token or the original authorization reference, not the CVV.

Why can't the CVV be stored after authorization?

PCI DSS Requirement 3.2 bans storage of sensitive authentication data after authorization, and Requirement 3.3 names the CVV. The exception covers issuers and companies that issue cards, which need the data to validate transactions.

The logic is plain. A stolen PAN is one problem. A stolen PAN plus its CVV is a working card number for card-not-present fraud. Keeping the code anywhere raises the value of a breach.

This applies to paper, spreadsheets, CRM notes, call recordings, and support chat logs. If a code lands in a log file, that system falls in scope for PCI DSS.

Network tokens vs merchant tokens: what changes for the CVV?

A merchant token is issued by a payment service provider and works at that provider. A network token is issued by the card network, such as Visa Token Service or Mastercard Digital Enablement Service, and works across merchants that accept it.

Neither token carries a CVV. Both replace the PAN. The difference comes down to where the token works and who can map it back to the account.

• Merchant tokens: fast to issue, tied to one processor, useful for subscriptions and card-on-file billing.
• Network tokens: portable, refreshed when a card is reissued, used by wallets and card-on-file programs.
• Both types: the CVV still has to be collected at the point of first authorization if the merchant needs it.

Does tokenization remove the CVV requirement at checkout?

Not for a first purchase. Card networks require the CVV for most card-not-present transactions, and a token does not replace that check.

For later charges on the same card, the merchant uses a stored credential and a token. No CVV is present, and the transaction runs as a merchant-initiated transaction under network rules.

Some regions and some issuers allow CVV-less processing for low-risk or recurring payments. Rules differ by network and country, so a merchant should confirm the details with its acquirer.

What happens to the CVV in subscriptions and one-click checkout?

The first payment collects the card details and the CVV. Once approved, the merchant stores a token and a credential on file instead of the code.

Renewals then run without a CVV. If the issuer declines and asks for cardholder verification, the customer has to re-enter the code or complete 3D Secure.

Common mistakes that expose CVV data

• Writing the code into an order note or CRM field for reference.
• Letting the payment form post to a server the merchant controls.
• Logging full request bodies that include the CVV field.
• Asking customers for the code over chat or email.
• Keeping call recordings where a cardholder reads the number out loud.

Each one turns a lower-risk system into a higher-risk one. Auditors look for these patterns first.

FAQ

Is the CVV ever tokenized?

No. Tokenization covers the PAN and, in some formats, the expiry date. The CVV is sensitive authentication data and is never replaced by a token, because there is nothing to substitute: it is used once and deleted.

Can a merchant store the CVV if it is encrypted?

No. PCI DSS bans storage of the CVV after authorization regardless of encryption, hashing, or truncation. Encryption protects data in transit and at rest, but it does not make stored CVV data compliant.

What does a CVV failure mean?

The issuer rejected the code. Common causes are a typo, a mistyped card number, or a card that does not match the code entered. The merchant should ask the customer to re-enter the data rather than retry the same code.

Do digital wallets send the CVV?

Wallet payments use a network token and a cryptogram instead of the PAN and CVV. The wallet authenticates the cardholder through the device, so the merchant never sees the code.

Does tokenization lower PCI DSS scope?

It reduces scope. A merchant that uses a hosted payment page and stores only tokens can qualify for a shorter self-assessment questionnaire. Scope does not reach zero, because the checkout page, the token vault, and any system that touches card data still count.