What is CVV/CVC?
CVV (Card Verification Value) and CVC (Card Verification Code) are the 3-4 digit security codes printed on payment cards, used to verify card possession during card-not-present transactions. Visa calls it CVV2, Mastercard calls it CVC2, and American Express calls it CID (4 digits on the front). The code is not stored in the magnetic stripe or chip, so it theoretically can only be obtained by someone who has physical access to the card.
Why It Matters
CVV provides a basic fraud check by verifying the customer has the physical card, not just stolen card numbers. Card network rules require CVV collection for most card-not-present transactions, and failure to capture it can result in interchange downgrades. CVV is not allowed to be stored after authorization, which is why you must re-enter it for each transaction.
Related Terms
Address Verification Service (AVS)
A fraud prevention tool that verifies billing address information with the card issuer.
Card-Present vs Card-Not-Present
Classification of transactions based on whether the physical card is used at the point of sale.
Tokenization
Replacing sensitive card data with a non-sensitive placeholder (token) for secure storage.
PCI Compliance
Adherence to security standards for organizations that handle credit card data.
Frequently Asked Questions
No. PCI DSS prohibits storing CVV after authorization. For recurring billing, use tokenization—the initial transaction captures CVV, then subsequent charges use the token.
On Visa, Mastercard, and Discover, it's the 3 digits on the back signature panel. On American Express, it's the 4 digits on the front of the card.
CVV mismatch typically indicates fraud or data entry error. Most merchants decline transactions with CVV mismatch, though you can configure your gateway's behavior.
Simplify your payment operations
Anchorbase connects payments directly to your ERP with automated reconciliation. Zero platform fees.