What Is a Card Verification Value (CVV)?

A Card Verification Value (CVV) is a security feature on payment cards that protects against unauthorized use. This numerical code verifies transaction legitimacy, especially when the physical card is not present. Its purpose is to add a layer of security, ensuring the person using the card is the authorized cardholder. The CVV is distinct from the primary card number or Personal Identification Number (PIN).

Understanding the Card Verification Value

The Card Verification Value (CVV) is a unique security code used to authenticate card ownership during transactions where the physical card is not swiped or inserted. This includes purchases made online, over the phone, or through mail order. The CVV acts as a safeguard, confirming legitimate access to the card.

This security feature is known by several names across different card networks. Common alternative terms include Card Verification Code (CVC) for Mastercard, Card Identification Number (CID) for American Express, and Card Security Code (CSC). These codes are three or four digits long.

Locating Your Card Verification Value

The placement of the Card Verification Value (CVV) varies by card issuer. For most Visa, Mastercard, and Discover cards, the CVV is a three-digit number on the back of the card, found in the signature strip. This number is printed, distinct from the main card number.

American Express cards feature a four-digit Card Identification Number (CID). This code is on the front of the card, above the account number. If the CVV becomes illegible or cannot be found, contact the card issuer to obtain the correct number.

The Role of CVV in Transaction Security

The CVV mitigates fraud, especially in card-not-present (CNP) transactions. When a consumer provides the CVV, it confirms physical possession of the card, rather than just having access to stolen card numbers or expiration dates.

Merchants are prohibited from storing this code after a transaction has been authorized. This is a requirement under the Payment Card Industry Data Security Standard (PCI DSS), which sets security standards for companies handling credit card information. By not retaining the CVV, even if a merchant’s database is compromised in a data breach, the CVVs cannot be stolen, making it harder for fraudsters to complete unauthorized purchases.

Using CVV for Online and Phone Purchases

When making purchases online or over the phone, consumers are prompted to enter their Card Verification Value (CVV) as part of the payment process. This step is a standard security measure designed to verify that the person making the purchase is the legitimate cardholder. Entering the correct CVV confirms physical possession of the card, which is particularly important in environments where the card cannot be physically swiped or inserted.

If an incorrect CVV is entered during a transaction, the payment will be declined, signaling a security mismatch. It is important to only provide the CVV when explicitly requested by a legitimate merchant during a purchase, such as on secure e-commerce websites or when speaking directly with a customer service representative. Sharing the CVV unnecessarily, such as through unsecure channels like text messages or email, should be avoided to protect card information from potential misuse.