The short answer
CVV verification software checks the 3 or 4 digit security code on a payment card against the issuing bank's records, at the moment of authorization. A match tells you that the digits typed into the checkout form agree with what the issuer has on file. It does not tell you the buyer is the cardholder. Those are two different claims, and merchants who blend them together tend to eat chargebacks.
Which code is being checked
A single card carries more than one verification value, and they are not interchangeable:
Maximizing Security: The Importance of CVV Validation Software
- CVV1 or CVC1 sits in the magnetic stripe and is read by the terminal on a swipe.
- CVV2, CVC2 or CID is the printed code near the signature panel or on the front of the card. This is the one an online form asks for.
- iCVV lives in the chip and differs from the stripe value, which is how cloned stripe data gets caught at a dip.
For card-not-present orders, your checkout collects the printed code and hands it to the gateway. The gateway puts it into the authorization request to the issuer. You never see the issuer's stored value, and there is no legitimate reason you would need to.
Reading the result
The issuer returns a result code with the approval or decline. Visa, for example, uses M for match, N for no match, P for not processed, S for code should have been on file but was missing, and U for unavailable. Most fraud teams treat N and S as a review trigger rather than an automatic block, because a mistyped digit is common and a hard decline costs a real sale. The pattern across many orders matters more than any single result.
Where it fits next to other checks
Address Verification Service compares the billing street number and ZIP against the issuer's file. 3-D Secure pushes the cardholder through an authentication step with their bank. Velocity rules look at how many cards one device, IP or shipping address touches in a short window. CVV verification is one signal among these. On its own it catches casual misuse of a stolen card number, nothing more.
The rules you cannot design around
PCI DSS classifies the card verification value as sensitive authentication data. It must not be stored after authorization, encrypted or otherwise, and it should not appear in logs, error messages or support tickets. Any vendor that offers to vault the CVV for recurring billing is selling you a compliance problem. Ask for their PCI attestation before you sign anything.
A note on listings that sell CVV data
There is no legitimate marketplace where you buy a card verification value. Listings that claim to sell them are trading stolen account data, and the numbers being sold are usually dead, recycled or bait. Purchasing or using that data is a federal crime in the US, and it is also a fast way to get your own accounts and payment credentials compromised. If you run a store, the only CVV work worth doing is verification on your own checkout and fraud review on your own orders.