A CVV authentication check is the authorization step where an issuing bank compares the card verification value sent with a transaction against the value it holds on file for that card. A match lets the card-not-present purchase proceed; a mismatch triggers a decline even when the card number and expiry date are correct. The check exists to show that the buyer physically holds the card.
What is the CVV on a card?
The CVV is a short numeric code the issuer generates when the card is produced. It is not part of the account number and it is not derived from it. Two forms exist: the value encoded on the stripe or chip, and the value printed on the card face.
CVV Security Check: What to Look For in Card Verification
- CVV2 / CVC2 / CID: three digits on the signature panel for Visa, Mastercard, and Discover, or four digits on the front for American Express. Used in card-not-present channels.
- CVV1 / iCVV: encoded in the magnetic stripe or chip. Used in terminal and face-to-face transactions.
How does the CVV authentication check work?
- The customer submits the card number, expiry date, and printed CVV.
- The payment gateway encrypts the data and places it in the authorization request.
- The issuing bank recomputes the expected code from its keys and the card data.
- The issuer returns an approval, a decline, or a CVV-specific response code.
The check runs inside the authorization message, so it adds no extra step for the buyer. It executes alongside address verification and the issuer's own risk scoring.
Why do CVV authentication checks fail?
Most failures come from a mistyped digit, the wrong card variant, or a card that was recently reissued. Issuers also decline when the code is missing on a channel that requires it. Repeated failures on the same card are a strong fraud signal and often trigger a velocity block.
Common issuer responses include "CVV2 mismatch," "CVV2 not present," and "cannot verify CVV." Each points to a different remedy: retry the entry, ask the customer to re-read the card, or route the order to a stronger verification method.
Can a merchant store the CVV?
No. PCI DSS Requirement 3.2 prohibits retaining the CVV2 after authorization in any form, including encrypted. Merchants that keep the code for subscription billing or customer convenience fall out of compliance and cannot pass a fresh check on later charges. Tokenization and network tokens are the approved substitutes for repeat billing.
How does a CVV check compare with AVS and 3-D Secure?
Each control tests a different thing. The CVV check tests possession of the physical card, AVS tests knowledge of the billing address, and 3-D Secure tests the cardholder's identity with the issuer.
- CVV check: strong against number-only data leaks, weak against full card dumps.
- AVS: useful in the US, UK, and Canada, less reliable where address formats vary.
- 3-D Secure: shifts fraud liability to the issuer when authentication succeeds.
What does a CVV check not do?
It does not confirm that the buyer is the cardholder. A stolen card number paired with a stolen CVV passes cleanly. That gap is why issuers stack AVS, device fingerprinting, velocity limits, and issuer authentication on top of the code.
What happens when a transaction passes the CVV check but is still fraudulent?
The chargeback lands on the merchant unless liability was shifted through issuer authentication. A passed CVV check is evidence of a valid code, not proof of an authorized buyer. Merchants should treat it as one signal among several in a layered review.