Visa CVV validation is the process VisaNet uses to check the card verification value supplied in a card-not-present transaction against the value the issuer has on file. The result comes back to the merchant as a match, a no-match, or not processed, and it travels inside the authorization response alongside the approval or decline. A CVV match confirms the code was correct. It does not confirm that the person using the card is the cardholder.
What the CVV actually is
Visa assigns several verification values to a single card, and each one is used in a different environment:
- CVV2 (printed as CVC2 on some cards) is the three-digit code on the back of the card, used for online, phone, and mail orders.
- CVV1 is encoded in the magnetic stripe and is checked when a card is swiped at a terminal.
- iCVV is stored in the chip and is validated during EMV transactions.
Only CVV2 is visible to a customer, which is why it is the value e-commerce checkouts ask for.
Guide to Using Test CVV Visa for Online Transactions
How validation works during an authorization
- The customer types the card number, expiration date, and the three-digit code into the checkout.
- The merchant or its payment gateway passes those values in the authorization request.
- The issuer compares the submitted code with the value it has on file for that account.
- The issuer and VisaNet return a code that reports the comparison result to the merchant.
The check happens inside the authorization message. It is not a separate lookup, and there is no partial match. Either the digits are right or they are not.
Reading the response correctly
A match result means the code was correct for that card number. A no-match result means it was not. A not-processed result usually means the issuer does not participate in the service or the field was missing from the request. None of these results tells you whether the card is stolen, whether the account is in good standing, or whether the buyer is authorized to use the card. Those questions are answered by other tools.
CVV, AVS, and 3-D Secure are different checks
Address Verification Service compares the billing street address and postal code. CVV validation compares the printed security code. 3-D Secure pushes the customer to the issuer for an extra authentication step. Merchants often run all three at once, and each one returns its own result code. A transaction can pass one check and fail another.
Why a merchant cannot store the code
PCI DSS classifies the card verification code as sensitive authentication data and prohibits retaining it after an authorization is complete. That is why a returning customer has to re-enter the digits every time, and why a printed receipt never shows them. Storage restrictions apply to any system that touches card data, including a payment gateway or a customer relationship tool.
Common reasons a check fails
- The customer mistyped a digit or mixed up the code with a PIN.
- The card is a corporate or prepaid product that places the code in a different position.
- The checkout sent a blank field or a placeholder value.
- The transaction is a recurring payment where the merchant has no way to collect the code again.
Card verification values exist to protect cardholders and merchants. The only legitimate source of a CVV is the card itself, and buying, selling, or using card data that belongs to someone else is illegal. A checkout that validates the code correctly, stores nothing it should not, and pairs the result with AVS and authentication will get more protection out of the check than a result read in isolation ever provides.