Credit card verification software checks the card number, expiry date, and security code against the issuing bank before a merchant approves an order. It runs inside the normal authorization request, so the customer sees nothing beyond the usual checkout screen. A failed check means the issuer did not confirm the data, and the order should go on hold instead of shipping.
CVV Check Software: Ensuring Security When Buying CVV Online
What does the software check?
Four checks cover most of the risk, and each one answers a different question about the card and the person typing it in.
- Card number: the Luhn formula catches typos, and an issuer lookup confirms the account exists.
- Expiry date: a mismatch points to a mistyped card or invented data.
- CVV: the three digits on the back of most cards, or four on the front of an American Express card. The issuer compares it to its file.
- Billing address (AVS): the street number and ZIP code get matched against the address the bank holds.
Some setups add 3-D Secure, which sends the cardholder to their bank's app for a one-time code. That step moves fraud liability to the issuer when the payment goes through.
CVV Authentication Software: What It Actually Checks at Checkout
How a CVV check runs during checkout
- The customer types card data into fields hosted by the payment processor, not by the merchant's server.
- The processor encrypts the data and sends an authorization request to the card network.
- The network routes the request to the issuing bank, which compares the CVV to the value on file.
- The bank returns a response code for the CVV and a separate code for the address check.
- The processor passes both results to the merchant, who decides whether to approve, hold, or decline the order.
The check adds no extra step for the shopper and no extra cost on the transaction. It runs in the same round trip that confirms the card has funds.
What do the CVV response codes mean?
The issuer sends a single letter back with the authorization response. Merchants who read that letter make better calls than merchants who see only "approved" or "declined."
- M: match. The code typed matches the issuer's file.
- N: no match. The code typed does not match the issuer's file.
- P: not processed.
- S: the issuer does not take part in CVV checks.
- U: the issuer cannot check the code right now.
An N paired with a ZIP match is one of the strongest fraud signals in card-not-present payments. An S or U means the check gave no answer at all, so any decline rests on other data.
Why you cannot store the CVV
PCI DSS Requirement 3.2 bans storage of the card verification value after authorization, even in encrypted form. The code is the one piece of card data that shows the buyer holds the physical card, so a leaked database with CVVs turns a breach into ready-made fraud.
Watch for quiet violations: a payment log that records the full request, a support inbox with card details pasted in, a database column left over from testing. Tokenization solves the problem by swapping the card number for a token the processor can map back on its own side.
CVV2, CVC2, CID: same field, four names
- Visa calls it CVV2, three digits on the back.
- Mastercard calls it CVC2, three digits on the back.
- American Express calls it CID, four digits printed on the front.
- Discover calls it CID, three digits on the back.
What to look for in credit card verification software
- Card fields hosted by the gateway, so the code never touches your server.
- Separate AVS and CVV response codes in the dashboard, not one blended pass or fail flag.
- Rules you can set, such as holding orders when CVV fails and the address matches.
- Support for 3-D Secure 2 and network tokens.
- Chargeback reporting linked to the verification result, so you can see which rules earn their keep.
Why good customers fail a CVV check
A failed CVV is a signal, not proof of fraud. Plenty of honest orders come back with an N or a U.
- A brand new card the issuer has not linked to the account record yet.
- Virtual and single-use cards from banks that skip the check.
- Corporate cards where the code sits with a finance team, not the buyer.
- A plain typo, common on mobile keyboards with small fields.
A policy that cancels every order with an N will cost you sales. A policy that holds the order, contacts the customer, and checks order history keeps more of them.
Frequently asked questions
Is CVV verification the same as AVS?
No. CVV checks the three or four digit code on the card, while AVS checks the billing street number and ZIP code. Both run in the same authorization request and return separate codes, so read them together.
Can a merchant ask for the CVV by phone or email?
PCI DSS forbids storing the code after authorization, and asking for it by email or chat puts it in a place where it will be stored. Take card data through a hosted payment page or a phone system that masks the code.
Does a CVV check stop chargebacks?
It cuts some fraud, but it does not block a chargeback. A cardholder can still dispute a charge for reasons unrelated to fraud, such as a missing delivery. Keep delivery proof and a clear billing descriptor.
What does credit card verification software cost?
Most processors include CVV and AVS checks in the per-transaction fee and charge nothing extra for them. You pay for the gateway, and 3-D Secure may carry a small per-check fee with some providers.
Do mobile wallets use the CVV?
Apple Pay and Google Pay send a device token and a cryptogram instead of the code printed on the card. The issuer checks the cryptogram, so the CVV never comes into play.