CVV Verification Case: How Card Security Code Checks Work
A CVV verification case is one card-not-present transaction where the issuer checks the security code. Learn response codes, liability shift, and PCI rules.
CVV Validation Example: Format Check and Response Codes
Short answer
A CVV cannot be validated by a merchant, a developer, or a third party. The card verification value is checked by the issuing bank when the authorization request reaches it. The merchant checks the format of the field, sends the value to the processor, and reads back a response code.
What the CVV is
The code is printed on the card, not encoded in the magnetic stripe, and not stored on the EMV chip. Visa, Mastercard, and Discover use 3 digits. American Express uses 4 digits and labels it the CID. The value proves the card is in hand during a card-not-present transaction.
Format check, step by step
- Remove spaces and dashes from the input string.
- Reject any character that is not a digit.
- Require 3 digits for Visa, Mastercard, and Discover.
- Require 4 digits for American Express.
- Keep leading zeros. They are part of the code.
- Send the value to the processor in the authorization request.
The Luhn algorithm belongs to the card number (PAN) field, not to the CVV field. Running Luhn on the CVV returns noise.
What the response codes mean
- M: the code matches.
- N: the code does not match.
- P: the check was not processed.
- U: the issuer does not support the check.
- S: the card should carry a code, but none was sent.
These codes come from the issuer. A site that pretends to produce them on its own is reporting a format pass, not a match.
CVV Test Example: How to Safely Validate Credit Card Details
Sandbox testing
Payment processors publish test card numbers for sandbox use. Each test number carries a fixed CVV. Send that value and the sandbox returns M. Send any other value and it returns N. This is the standard way to test a checkout form without a real card.
Storage rule
PCI DSS classifies the CVV as sensitive authentication data. Requirement 3.3 bans storage of the value after authorization, in any form, including encrypted. A system that keeps CVVs in a database fails the standard and cannot pass an assessment.
Common errors
- Applying a 3 digit rule to American Express.
- Trimming leading zeros during type conversion.
- Running a Luhn check on the CVV field.
- Logging the raw value to an error file.
A field that passes a format check is not a valid card. Only the issuing bank can confirm that the code on the plastic matches the account.