CVV and CVC are names used for card verification codes: short security values printed on, or otherwise provided with, a payment card to help verify card details during transactions where the physical card is not being read by a payment terminal.
The exact name depends on the payment brand. PCI Security Standards Council uses the general term card verification code and notes that common brand terms include CVV2, CVC2, CID and CAV2.
These codes are especially relevant to card-not-present payments such as ecommerce. They are an additional verification signal, but they are not a password, PIN, cardholder identity check or guarantee that a transaction is legitimate.
Quick answer: A CVV or CVC is usually a three- or four-digit card security code used as an additional verification value during card-not-present authorization. PCI DSS classifies printed card verification codes as Sensitive Authentication Data and prohibits merchants from storing them after authorization, even if encrypted.
What Does CVV Mean?
CVV stands for Card Verification Value. Visa uses the term CVV2 for the printed or displayed card verification value used in card-not-present transactions.
Visa's current rules define CVV2 as a unique check value generated using a secure cryptographic process. Visa authorization systems can return a result indicating whether the CVV2 submitted by a merchant matched the expected value.
What Does CVC Mean?
CVC is a common Mastercard term for the card security code, typically called CVC2 when referring to the printed card-not-present verification value.
Although the branding differs, CVV2 and CVC2 serve the same broad purpose: they provide an additional piece of card information that can be checked during authorization.
CVV, CVC, CID and Other Names
Common term | Typical brand usage | General purpose |
|---|---|---|
CVV2 | Visa | Printed/displayed card verification value |
CVC2 | Mastercard | Printed card verification code |
CID | American Express terminology commonly used for card identification | Printed card security value |
CAV2 / CVN2 | Other participating payment-brand terminology | Printed card verification value |
PCI SSC groups these terms under the broader category of card verification codes and notes that they are normally three or four digits.
Where Is the CVV or CVC Located?
The location and number of digits depend on the card brand and card design. Many Visa and Mastercard cards display a three-digit security code on the back of the card. Some American Express cards use a four-digit code on the front.
Virtual cards can display a security code digitally rather than on a physical piece of plastic. Consumers should use the issuer's official app or account interface to view virtual-card security information.
Why Does the Code Exist?
Card verification codes add another signal to card-not-present authorization. PCI SSC states that merchants commonly request them in ecommerce and other CNP transactions to help verify that the customer has access to the card.
Visa similarly describes CVV2 as a tool that helps merchants validate card possession in internet or telephone-order transactions.
How a CVV/CVC Check Works
1. The customer enters the card security code.
The code is provided during a legitimate checkout or other authorized card-not-present payment.
2. The merchant submits the value for authorization.
The merchant or payment provider sends the code along with the relevant payment request.
3. The issuer or network verifies the code.
The submitted value is compared with the expected value using secure payment infrastructure.
4. A result is returned.
The merchant can receive a result such as match, no match, unable to verify or not performed, depending on the network and issuer.
5. The merchant combines the result with other fraud controls.
CVV/CVC is one risk signal alongside authorization, AVS, 3-D Secure, device context and other fraud checks.
What Do CVV2 Result Codes Mean?
Visa's current developer documentation lists several common CVV2 outcomes. Merchant implementations should always use the documentation for their own processor or network because result handling can vary.
Result type | General meaning |
|---|---|
Match | The submitted value matched. |
No match | The submitted value was verified but did not match. |
Not performed | Verification was not completed in that transaction flow. |
Unable to verify | The issuer or service could not verify the value. |
System/retry condition | A temporary or data-related problem prevented a normal verification result. |
Does a CVV Match Mean the Payment Is Safe?
No. A successful CVV/CVC match is useful, but it does not prove the shopper is the legitimate cardholder.
A payment can still be fraudulent if multiple card details were compromised together. Retailers should combine the CVV result with issuer authorization, account history, AVS where available, 3-D Secure, device signals and broader risk scoring.
Does a CVV Mismatch Mean Fraud?
Not automatically. A mismatch can result from a typing error or an outdated or incorrectly entered value, but it is an important risk signal.
Merchants should follow their payment provider's fraud policy rather than relying on one verification result as universal proof.
CVV/CVC vs PAN
Feature | PAN | CVV/CVC |
|---|---|---|
Purpose | Identifies the payment-card account | Adds a card-verification signal |
Typical length | Depends on payment-account numbering structure | Usually 3 or 4 digits |
Storage | Can be stored only when properly protected and legitimately needed | Must not be stored after authorization |
Use in CNP payment | Core payment credential | Additional verification value |
CVV/CVC vs PIN
A CVV/CVC is not a PIN. A PIN is a personal identification number used in specific cardholder-verification and account-access contexts. The printed card security code serves a different payment-security function.
CVV/CVC vs 3-D Secure
CVV/CVC verifies a card security value. EMV 3-D Secure helps the issuer authenticate the consumer using transaction, payment and device context and, when needed, an additional challenge.
CVV/CVC vs AVS
- AVS compares submitted billing information with issuer records where supported.
- CVV/CVC checks whether the submitted card security code matches.
- Neither one independently proves cardholder identity.
- Using several independent signals can provide a stronger fraud-prevention picture.
Why Merchants Must Not Store CVV or CVC After Authorization
PCI SSC states that card verification codes are Sensitive Authentication Data and cannot be stored after authorization - even if encrypted. The rule applies to CVV2, CVC2, CID, CAV2 and equivalent printed card verification values.
PCI SSC also states that customer permission does not make post-authorization storage acceptable.
What About Recurring Payments or Saved Cards?
Merchants do not need to retain CVV/CVC for legitimate recurring or card-on-file payments. PCI SSC explicitly states that card verification codes must not be kept for future recurring transactions.
Payment providers can use tokenization and other approved stored-credential mechanisms without retaining the security code.
Can a Browser or App Save the CVV?
Merchants and service providers subject to PCI DSS cannot retain card verification codes after authorization simply to make future payments easier.
PCI SSC has clarified that applications, browser-like services and other providers cannot store these codes on behalf of consumers for future payment use, except for limited issuer-side cases outside ordinary merchant acceptance.
What About Phone Payments and Call Recordings?
PCI SSC states that audio recordings must not retain card verification codes after authorization. Where possible, organizations should suppress or redact the sensitive part of a call recording during data entry.
What Consumers Should Do to Protect Card Security Codes
- Enter the code only on legitimate checkout pages or through trusted payment channels.
- Do not send the code through ordinary email or chat unless the payment process explicitly and securely supports it.
- Do not read the code to an unexpected caller claiming to be your bank.
- Be suspicious of messages asking you to 'verify your card' through an unfamiliar link.
- If card details and the security code may have been exposed, contact the card issuer promptly.
- Use issuer transaction alerts to notice unauthorized activity quickly.
What Merchants Should Do
- Collect CVV/CVC only when needed for authorization.
- Do not store it after authorization, even in encrypted form.
- Configure payment systems and logs so the code is not retained.
- Do not record the code in customer-service notes, screenshots or call recordings.
- Use tokenization rather than retaining raw card credentials for legitimate saved-payment use cases.
- Combine CVV/CVC results with AVS, 3-D Secure and broader fraud controls.
Common Misunderstandings
- Myth: CVV and CVC are completely different technologies. Reality: they are brand-specific names for closely related card verification values.
- Myth: A CVV match proves the buyer owns the card. Reality: it is one verification signal, not identity proof.
- Myth: Merchants can store CVV if the customer agrees. Reality: PCI DSS prohibits post-authorization storage regardless of customer permission.
- Myth: CVV is the same as a PIN. Reality: they serve different security functions.
- Myth: A saved card requires the CVV to be stored. Reality: recurring and card-on-file systems can use approved stored credentials and tokenization without storing CVV/CVC.
Frequently Asked Questions
What is a CVV code?
A CVV is a card verification value used as an additional security check during card-not-present payments. Visa commonly uses the term CVV2 for the printed or displayed code.
What is a CVC code?
CVC is a card validation or verification code term commonly associated with Mastercard. CVC2 is the printed card security value used in card-not-present payments.
Is CVV the same as CVC?
They are different brand names for closely related card security codes used for similar verification purposes.
How many digits is a CVV or CVC?
Card verification codes are normally three or four digits, depending on the payment brand and card design.
Is a CVV the same as a PIN?
No. A CVV/CVC is a card security code; a PIN is a personal identification number used in different cardholder-verification contexts.
Is CVV part of the card number?
No. The PAN/card number and CVV/CVC are separate data elements.
Can a merchant store my CVV?
PCI DSS prohibits merchants from storing card verification codes after authorization, even if encrypted.
Can a merchant store CVV for a subscription?
No. PCI SSC explicitly prohibits retaining the code for card-on-file or recurring transactions.
Does a CVV match guarantee a legitimate payment?
No. A match is useful, but merchants should combine it with authorization, authentication and broader fraud-risk signals.
What should I do if someone knows my CVV and card number?
Contact the card issuer through a trusted channel and explain that the card information may be compromised. Follow the issuer's instructions for locking or replacing the card.
Final Thoughts
CVV, CVC, CVV2, CVC2 and CID are different names used for card security values that help verify card details during card-not-present payments.
The code is useful because it adds another verification signal beyond the Primary Account Number. But it does not identify the shopper by itself and should always be combined with authorization, authentication and other fraud controls.
For consumers, the key rule is simple: treat the code as sensitive. For merchants, the rule is even stricter: collect it only when legitimately needed for authorization and never retain it afterward.
Authoritative References
- PCI Security Standards Council - Card Verification Code Glossary
- PCI Security Standards Council - Are Merchants Allowed to Request Card Verification Codes?
- PCI Security Standards Council - Can Card Verification Codes Be Stored for Recurring Transactions?
- PCI Security Standards Council - Card Verification Codes in Consumer Applications
- PCI Security Standards Council - Sensitive Authentication Data in Voice Recordings
- Visa - Request and Response Codes: CVV2 Results
- Visa Core Rules - CVV and CVV2 Definitions
Editorial note: This article is educational and focused on payment-security awareness. Example card information is masked or illustrative, and no real card credentials are provided.
