What CVV test accessibility means

CVV test accessibility is the check of a card security code field against accessibility standards. The field needs a programmatic label, a numeric keypad on mobile, and an error message a screen reader can read. Testers combine automated tools with manual screen reader passes. The code is 3 digits for Visa, Mastercard, and Discover, and 4 digits for American Express.

Field markup that passes

  • A visible label bound to the input with matching for and id attributes. Placeholder-only labels vanish on input and break at high zoom.
  • autocomplete set to cc-csc, the HTML token for a card security code. Browsers do not store or fill CVV values, so the token helps assistive tech name the field more than it helps autofill.
  • inputmode set to numeric and maxlength set to 3 or 4. This opens a digit keypad on iOS and Android.
  • Target size of at least 24 by 24 CSS pixels under WCAG 2.2 Success Criterion 2.5.8.
  • Text contrast of at least 4.5 to 1 under Success Criterion 1.4.3.

Automated tools

axe, WAVE, and Lighthouse flag missing labels, duplicate ids, and contrast failures. Deque figures put automated detection at roughly 30 to 40 percent of accessibility defects. A CVV field with a correct label and no contrast issue can still fail manual checks.

Manual checks

  1. Tab to the field. Confirm the focus ring is visible and the label is announced.
  2. Read the field with NVDA, JAWS, VoiceOver, or TalkBack. Confirm the announced name includes the card security code, not just edit text.
  3. Submit a wrong code. Confirm the error text is tied to the field with aria-describedby and is announced.
  4. Zoom to 200 percent. Confirm the label, field, and error stay on screen.
  5. Complete the form with a keyboard alone. No pointer input.

Errors and time limits

Error messages must name the field and the fix under WCAG 3.3.1 and 3.3.3. Do not clear the whole form when one code is wrong. Checkout timeouts fall under Success Criterion 2.2.1, which requires a way to turn off, adjust, or extend the limit, with an exception for limits longer than 20 hours.

What testing cannot change

PCI DSS v4.0 requirement 3.2.1 prohibits storing sensitive authentication data, which includes the CVV, after authorization. That rule governs storage, not accessibility. It does explain why autofill behavior for cc-csc differs across Chrome, Safari, and Firefox. Test the field with autofill off and with a paste action, since some scripts block paste and break keyboard users.