Visa CVV verify: the short answer
CVV verification is a check run by the card issuer during authorization. The merchant sends the three-digit code printed on the back of a Visa card. The issuer compares that value to the value on its own record. A match returns a match response. A mismatch returns a no-match response. Most merchants decline the sale on a no-match.
Where the code sits on a Visa card
Visa prints CVV2 in the signature panel on the back of the card, to the right of the last four digits of the account number. It is three digits. The code is not embossed and is not part of the account number.
American Express uses a four-digit CID printed on the front. Mastercard calls the same value CVC2. The networks handle these values in the same way. A second value, CVV1, is encoded in the magnetic stripe and read by terminals at a physical point of sale. Cardholders never see CVV1.
Visa Card CVV Test Guide: How to Conduct a Secure Check
What happens during authorization
The merchant sends the CVV2 value inside the authorization message. Visa routes the request to the issuer. The issuer returns a result code. Merchants see that code in the authorization response.
- M: the code matched the issuer record.
- N: the code did not match.
- P: the issuer did not process the check.
- U: the issuer could not run the check.
A no-match is one factor among several. Issuers weigh it against account status, spending pattern, and other data in the request.
Why merchants cannot store the code
PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after authorization. That set includes the full contents of the magnetic stripe, the card verification code, and PINs. A merchant that keeps CVV2 after a sale is out of compliance. The code can pass through the payment system for the check and no further.
CVV is not AVS or 3-D Secure
AVS compares the numeric parts of the billing street address and the ZIP code. 3-D Secure, sold by Visa as Visa Secure, adds a step where the issuer authenticates the cardholder in a browser or app.
CVV verification checks possession of the card. AVS checks the billing record. 3-D Secure checks the person. A merchant can run all three on one order.
Limits of the check
A CVV match does not prove the buyer is the cardholder. Card-not-present fraud still happens when a criminal holds both the account number and the code. Skipping the CVV check can cost a merchant chargeback rights on some transactions, because fraud liability shifts to the party that did not run the check.
What a cardholder can do
Treat the three-digit code the same as the account number. Read it aloud only to a merchant you contacted. No bank asks for CVV2 by phone, email, or text. A request for the code from an inbound caller is a sign of a scam.