A CVV website for sellers is any checkout or payment page that asks the buyer to type the 3-digit code from the back of a Visa, Mastercard, or Discover card, or the 4-digit code from the front of an American Express card. Sellers use that code to confirm the person entering the card number is holding the physical card. Card networks call this a card verification value check, and PCI DSS lets merchants verify a CVV but never keep it.
What Is a CVV?
CVV stands for card verification value. Visa coined the term. Mastercard uses CVC, American Express uses CID, and all of them do the same job: they prove the buyer has the plastic in hand, not just a card number copied from a breach.
- Visa, Mastercard, Discover: 3 digits printed in the signature panel on the back.
- American Express: 4 digits printed above the card number on the front.
- The CVV is not the PIN, and it is not printed on receipts or statements.
- Card networks group full card numbers, CVVs, PINs, and stripe data under one label: sensitive authentication data.
Why Do Sellers Ask for the CVV at Checkout?
In a store, the terminal reads the chip or the stripe. Online, the seller has no card to inspect, so the CVV becomes the closest thing to a hand check. A thief who buys a card number from a dump site often does not have the code that goes with it.
How to Safely Offer CVV on a Web Platform
- Fraud losses drop when stolen numbers without matching CVVs get declined.
- Chargeback cases get stronger when the record shows a CVV match at the time of sale.
- Several processors require a CVV on card-not-present transactions as a condition of the merchant agreement.
- The field costs the buyer a few seconds, so the conversion hit is small.
How Does a CVV Check Work During Authorization?
The check rides along with the normal authorization message. Nobody sees the code except the systems that need it.
- The buyer submits the card number, expiry, and CVV on your payment page.
- Your page or hosted field sends that data to the processor over an encrypted connection.
- The processor forwards it to the issuing bank inside the authorization request.
- The issuer compares the CVV to its own record and returns a result code.
- Your dashboard or gateway shows the outcome: match, no match, not processed, or issuer does not support the check.
A "not processed" or "unsupported" result is not proof of fraud, and a match is not proof of honesty. Treat both as one input among several.
Can a Seller Store CVV Data?
No. PCI DSS Requirement 3.2 bans storage of sensitive authentication data after authorization, and the ban holds even if the data is encrypted. That covers the CVV, the full magnetic stripe, and PIN blocks.
- You may pass the CVV through memory while the transaction authorizes.
- You may not write it to a database, a log file, a CRM, a help desk ticket, or a spreadsheet.
- You may not keep it "for the customer's next order" or for recurring billing.
- Card networks treat CVV storage as a serious violation that can cost you the merchant account.
This is the single rule that shapes most checkout design. If you cannot store the code, you also cannot let it sit in a queue, a cache, or a third-party analytics tool.
What Should Sellers Check Alongside the CVV?
The CVV is one data point. A working fraud program stacks several checks so no single failure sinks an order review.
- AVS compares the billing street number and ZIP code to what the issuer has on file.
- 3-D Secure (Verified by Visa, Mastercard Identity Check) moves liability to the issuer when authentication passes.
- Velocity rules flag the same card, device, or IP hitting your store many times in a short window.
- Manual review for high-ticket orders, mismatched shipping and billing addresses, and free email domains.
What Does a Compliant CVV Checkout Page Need?
Design choices follow from the storage ban. If the code cannot be kept, the safest path is to make sure it never touches your own servers.
- Serve the payment page over TLS 1.2 or higher, with no fallback to older protocols.
- Collect the CVV in a hosted field or send the buyer to a hosted payment page so the value goes straight to the processor.
- Mask the field on screen and block it from autocomplete and browser password managers.
- Scrub CVVs from logs, error messages, and analytics payloads before they ship anywhere.
- Tokenize the card number so anything stored on file is a token, not a PAN.
Most small sellers rent this compliance instead of building it. A hosted payment page or processor token can drop your PCI scope from a full assessment to a short self-questionnaire.
Why Buying or Selling CVV Data Is a Crime
A second meaning of "CVV website" shows up in search: sites that trade stolen card data. Those operations are illegal, and the law treats the buyer and the seller the same way.
- US federal law, 18 U.S.C. Section 1029, covers trafficking in unauthorized access devices, which includes payment card numbers and security codes.
- Card numbers and CVVs on those sites belong to real account holders who never agreed to the sale.
- Buyers of stolen card data face the same fraud charges as the people who list it.
- No legitimate processor or bank will underwrite a business whose product is other people's card data.
If you run a store and someone offers to sell you a CVV list or a ready-made "CVV shop" script, that offer is a fraud pitch. Report it to the FTC or to your acquiring bank.
Frequently Asked Questions
Is it legal for a seller to ask for a CVV?
Yes. Collecting the security code during a purchase is a standard part of card-not-present authorization and is allowed anywhere you accept the card brand.
Can I save a customer's CVV for their next order?
No. PCI DSS prohibits storing the CVV after authorization, so repeat buyers re-enter it each time. Store a processor token for the card number instead.
Does a CVV match prevent chargebacks?
No. It lowers risk and strengthens your evidence in a dispute, but a cardholder can still file one and win.
What is a CVV shop?
A site that sells stolen card records. Buying or selling that data is a federal crime in the US and a criminal offense in most other countries.