A CVV format test checks that a card security code has the right shape: three digits for Visa, Mastercard, and Discover, four digits for American Express, numeric characters with no letters or symbols. CVV verification goes further and asks the issuer to compare that code against the value on file, which returns a match, a mismatch, or no answer. Format checks run in your own code. Verification runs on the card network.
Both matter, and they solve different problems. A format test keeps bad input out of your payment form. Verification tells you whether the person typing the code holds the card.
CVV Formats Compared: 3-Digit vs 4-Digit Codes by Card Brand
What does a CVV format test check?
A format test is a validation rule, not a security control. It reads the field and accepts or rejects the shape of the input.
CVV Format Test: How to Validate Card Security Codes the Right Way
- Length: 3 digits for Visa, Mastercard, and Discover; 4 digits for American Express.
- Characters: digits 0 to 9. Letters, spaces, and punctuation fail.
- Presence: the field is filled before the buyer submits.
A common rule looks like ^\d{3,4}$. Teams run it in the browser for a fast error message and again on the server, since a client can be bypassed.
The Luhn algorithm does not apply to the security code. Luhn checks the card number. Mixing the two is a frequent source of bugs.
What does CVV verification check?
Verification is an authorization step. The gateway places the code in the authorization request, and the issuer answers with a single-letter response code.
- M: the code matches the value on file.
- N: the code does not match.
- P: the code was not processed.
- U: the issuer does not take part in verification.
- S: the code should have been on the request and was not.
Issuers never send the stored value back. You receive a match, a mismatch, or nothing at all. A mismatch does not always mean fraud, but it does shift the risk toward you in most card-not-present disputes.
Which CVV type is used where?
Three variants exist. CVV2 is printed on the card and is the one online forms collect. CVV1 sits on the magnetic stripe and appears in swipe transactions. iCVV lives on the chip and is used in EMV flows. E-commerce relies on CVV2.
CVV format test vs CVV verification: side by side
- Where it runs: format test in your application; verification at the issuer.
- What it proves: format test proves the input is well formed; verification proves a match with the issuer record.
- Speed: format test is instant; verification waits for the authorization response.
- Failure result: format test gives a form error; verification gives a decline or a risk flag.
- Storage: format test needs no stored code; verification data may not be stored after authorization.
Why do the two get mixed up in payment testing?
Sandbox test card numbers from gateways accept almost any well-formed code. A developer types 123, sees an approval, and assumes the verification logic works. It does not, because the sandbox skipped the issuer step.
This gap shows up in production. Real cards linked to real accounts reject wrong codes, and the decline rate changes.
How do you test CVV handling in a sandbox?
- Use the test card numbers published by your gateway. Never use live card data.
- Send a three-digit code with a Visa test card and confirm approval.
- Send a four-digit code to the same card and confirm the format rule fires.
- Send letters or an empty field and confirm the request never reaches the gateway.
- Trigger the mismatch response your gateway documents and check how the app shows a decline.
- Confirm the code appears in no log, database table, or error message.
Common mistakes in CVV handling
- Logging the code in request payloads or debug output.
- Storing the code to retry a failed charge. PCI DSS bans storage of sensitive authentication data after authorization.
- Treating a format failure as fraud instead of a typo.
- Accepting five or more digits because the regex lacked bounds.
- Assuming a mismatch always blocks a charge. Many issuers return U and let the transaction proceed.
Frequently asked questions
Does a CVV format test stop fraud?
No. A format test stops malformed input. Anyone can type three digits from a stolen card, so the rule carries no fraud signal on its own. Fraud tools score other data: device information, address checks, velocity, and card history.
Can you store a CVV after a transaction?
No. PCI DSS treats the CVV as sensitive authentication data and forbids storage after authorization, even in encrypted form. If your app needs repeat charges, store a network token from your gateway instead.
Is a CVV required for every online payment?
No. Rules differ by market and card type. Some regions issue cards without a printed code, and some recurring or merchant-initiated transactions run with no code on the request. Issuers then return U or P instead of M or N.
What to check before you ship
- Server-side length and character rules for 3 and 4 digit codes.
- Form messages that name the problem without echoing the value.
- A decline path for N and a pass path for U.
- Log scrubbing that drops the code field before it hits storage.