CVV
Also known as: CVC, Card security code
The 3-4 digit code that proves the shopper physically has the card.
The CVV (Card Verification Value) is the short security code printed on a card. Requesting it for card-not-present sales helps prove the buyer holds the physical card; card networks prohibit storing it after authorization.
How it works
Never keep the code. Card network rules and PCI DSS forbid storing it once the transaction is authorized, in any form, and the copy that catches merchants out may not be in the database at all: a note a phone-order agent typed into your CRM counts just the same. Check where your staff write things down.
The code itself is generated by the issuer from the card details, using keys only it holds. That is why it cannot be worked out from the card number, and why it is deliberately left off the magnetic stripe and the chip. Visa, Mastercard and Discover print three digits on the back; American Express prints four on the front. Your checkout sends the code up with the authorization request, and the issuer returns a separate match, no-match or not-processed result alongside its approval decision.
The result is advisory, not a decline. An issuer can approve the payment and report a mismatch in the same response, so your gateway rules decide what happens next. Most gateways can void a mismatch automatically, which is the safer default for anything you ship, and it costs you a small share of good orders: typos happen, and cards get reissued with new codes. A match is useful evidence if you have to defend a dispute. It proves possession, not liability, and will not move fraud losses to the issuer the way 3D Secure can.
Worked example
Losing the order is the cheap outcome. You take a $180 online order, the billing address partly matches, the security code comes back a no-match, and your gateway voids the sale automatically. Capture it instead and let it turn out to be fraud, and you are out the goods and the $180, plus a chargeback fee commonly between $15 and $40. The dispute counts towards your chargeback ratio too.
Frequently asked questions
- Can I store the CVV to charge the customer again later?
- Card network rules and PCI DSS prohibit it once the transaction is authorized, encrypted or not. Repeat and subscription charges run on a stored token instead, which is why a saved card never asks for the code again. Check the places it hides: CRM records, order notes, call recordings. Anywhere it turns up is a compliance problem, and it needs removing.
- Does checking the CVV protect me from chargebacks?
- Not from the ones that hurt. A match is useful evidence when you respond to a dispute, but it does not shift fraud liability to the issuer, so a card-not-present fraud chargeback still lands on you unless the transaction was authenticated through 3D Secure, which can move that liability. Treat the check as a filter that stops obvious fraud early, not as cover once the goods have gone.
- Should I decline every order where the code does not match?
- Decline by default. Most gateways can void a mismatch automatically, and for shipped goods that is the right setting. Relax it only when you can see genuine customers failing: some merchants queue mismatches for manual review instead, usually on low-value digital products or for known repeat buyers. Pull the mismatch rate from your gateway reports before you choose.