A CVV length test checks the number of digits in a card verification value. Visa, Mastercard, and Discover use 3 digits, while American Express uses 4 digits. The test confirms format only. It does not prove that a card is valid or that a CVV belongs to the cardholder, and CVVs must never be shared, bought, or sold.
What does a CVV length test check?
A CVV length test counts the digits in a card security code. It is a basic input check used in legitimate checkout forms to catch typing errors. It is not a validation method and cannot confirm that the code matches the card.
How long is a CVV by card network?
- Visa: 3 digits, often called CVV2
- Mastercard: 3 digits, often called CVC2
- Discover: 3 digits, often called CID
- American Express: 4 digits, often called CID
These lengths apply to the printed or embossed security code used in card-not-present transactions. The code is separate from the primary account number and is not the card PIN.
Why a length test is not card validation
Digit count cannot confirm that a CVV is correct. A random 3-digit or 4-digit string can pass a length check. Legitimate payment processors validate the CVV with the issuer during authorization, and that process is not visible to a checkout page.
Where should CVV length checks be used?
A length check belongs in a legitimate checkout form as a simple input constraint. It can reduce user error, such as a customer typing a 4-digit code for a Visa card. It should not be used to test cards, guess codes, or verify data from third parties.
What are the security rules for CVVs?
CVVs are sensitive authentication data. PCI DSS rules prohibit storing the CVV after authorization, even in encrypted form. Sharing, buying, or selling CVVs is illegal and exposes cardholders to fraud.
- Do not store CVV data after authorization.
- Do not ask customers to send CVVs by email or chat.
- Use a compliant payment processor for card validation.
FAQ
Is a CVV always 3 digits?
No. Most major networks use 3 digits, but American Express uses 4 digits.
Can a CVV length test detect a fake card?
No. Length is only a format check. It cannot detect a fake card or stolen data.
Is CVV2 the same as CVV?
CVV2 is Visa's term for the 3-digit code. Other networks use CVC2 or CID, and the length depends on the network.