CVV / CVC (Card Verification Value / Code)

CVV (Card Verification Value) and CVC (Card Verification Code) are the security codes printed on payment cards, typically three digits on the back of Visa, Mastercard, and Discover cards, and four digits on the front of American Express cards, that serve as a proof-of-possession mechanism for card-not-present transactions. Each card brand uses its own terminology: Visa calls it CVV2, Mastercard calls it CVC2, and Amex calls it CID, but all refer to the same type of security code.

The purpose of the CVV/CVC is to verify that the person making an online payment has physical possession of the card, not just the card number. Because CVVs are printed rather than embossed, they do not appear on carbon copy imprints of the card, and crucially, they are not stored in the card's magnetic stripe data. This means that even if a fraudster obtains the track data from a compromised card swipe, they cannot derive the CVV from that data. The CVV must be read from the physical card.

Under PCI DSS, CVV data is classified as Sensitive Authentication Data (SAD) and is subject to the most stringent data handling requirement in the entire standard: it must never be stored after authorization is complete, not in logs, not in databases, not in any form, even encrypted. This is a non-negotiable PCI requirement that is frequently violated by merchants who do not audit their logging and database configurations carefully.

In the context of 3DS2 / EMV 3-D Secure and Network Tokenization, CVV importance is evolving. Network tokens carry their own cryptographic authentication that provides stronger proof-of-possession than a CVV can, and some authentication flows do not require CVV submission when strong token-based authentication is in place.