Risk

Card verification value

Also: CVV, CVC, CVV2, CSC

The 3- or 4-digit code printed on a card, used to prove the cardholder physically holds the card.

The card verification value is a security feature used primarily in card-not-present transactions to verify that the customer has the physical card in their possession. While typically three digits on the reverse of Visa and Mastercard products, American Express uses a four-digit code known as a CID on the front of the card. During the authorisation process, the merchant sends this value to the acquirer, who forwards it to the issuing bank for validation against the record on file. To comply with PCI DSS requirements, merchants and service providers are strictly prohibited from storing the sensitive authentication data after the authorisation is complete, even if other card details are vaulted. Failure to provide a correct value often results in a soft decline by the issuer, though some merchants may choose to override certain checks at their own risk depending on their specific scheme thresholds and fraud appetite. This check remains a fundamental layer of risk management alongside 3DS and address verification services.