Card Security Code

What a card security code is

A card security code is a short, non-embossed number printed on a payment card. Visa, Mastercard, and Discover use a three-digit code on the back. American Express uses a four-digit CID on the front. The code is separate from the card number and expiration date.

The names differ by network and provider. You will see CVV or CVV2, CVC or CVC2, CSC, and CID. They refer to the same kind of security check, though the exact abbreviation depends on the card brand.

A code match is a useful fraud signal, not proof that the person paying is the cardholder.

How the code check works

For an online or phone purchase, your checkout can ask the customer to enter the code alongside the card number and expiration date. The processor sends it with the authorization request, and the issuer checks it against its records. The response reports whether the code matched, did not match, or could not be checked.

A match is one signal, not proof of identity. Someone holding a stolen physical card can read the code, and a successful check does not establish that the customer is authorized to use the card. Combine the result with the authorization decision and other relevant checks, such as address verification, rather than treating a match as a guarantee.

What it means for your costs and risk

The code itself has no separate line-item processing fee in the research available for this entry. It also does not change interchange or your processor markup. Its business value is risk screening: catching some purchases made with stolen card numbers and expiration dates before you fulfill an order.

A failed or unavailable code check needs a decision. Automatically rejecting every mismatch blocks some fraud, but also rejects legitimate customers who mistype a digit or use a card whose issuer does not support the check. Accepting every mismatch raises exposure to fraud, lost merchandise, and disputes. The code does not prevent every fraudulent transaction or guarantee protection from a chargeback.

How to handle the code

Treat the code as sensitive authentication data. Do not store it in customer profiles, transaction databases, or paper records after authorization. PCI rules prohibit retaining it after authorization, even if you encrypt it. A breach involving stored card numbers and expiration dates is less damaging when the code was never retained.

The code does not appear as a processing-fee line on your merchant statement, and it is not printed on the customer’s sales receipt. If you are reviewing a questionable online transaction, look for the code-check result in your payment system’s transaction details. Compare that result with the authorization response and your address-verification result; the code itself is not a statement fee to negotiate.

What you can actually change

1. 01
   Request it at checkout. For online and phone sales, include a code field in the authorization flow when your payment setup supports it. Review the code result alongside the authorization and address-verification results.
2. 02
   Never retain the code. Keep CVV, CVC, and CID out of customer records, logs, recordings, and order notes after authorization. Review your checkout and support workflows for places where staff might copy it.
3. 03
   Review failed checks. Set a clear process for mismatches and unavailable checks instead of accepting or rejecting every order automatically. Use the order amount, customer history, and other fraud signals in the decision.

Frequently asked questions