How a card security code works
The issuer generates the code with a secure cryptographic process, so the code cannot be worked out from the card number and the expiry date. The magnetic stripe carries a separate check value of its own, which the Visa Core Rules call the CVV, and the printed one is the CVV2.
At checkout the buyer types the code, the merchant sends it with the authorisation request, and the issuer answers whether the code matched. Some cards and apps show a code that changes over time, which the Visa rules call a dCVV2.
Card security codes and PCI DSS
PCI DSS classes the code as sensitive authentication data, together with full track data, PINs and PIN blocks. A merchant may collect the code for a payment, but may not retain the code once that payment is authorised, even encrypted and even with the customer's permission (PCI SSC, FAQs 1533 and 1574).
Card-on-file and recurring payments therefore run without the code after the first payment. Only issuers, and companies supporting issuing services with a legitimate business need, may store the code after authorisation.
What a card security code does not prove
A matching code shows that the buyer has the card's details, not that the buyer is the cardholder: details stolen from a breached shop or a phishing page include the code. Authenticating the person is the job of 3-D Secure.
Card security code, CVV or PIN?
- CVV on the magnetic stripe
- A check value encoded in the stripe and read by a terminal, which the cardholder never sees (Visa Core Rules, glossary).
- PIN
- A secret the cardholder knows, checked at terminals and cash machines. The security code is printed on the card, so anyone holding the card can read it.
Where a card security code shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- PCI SSC, Glossary: Card Verification Code, Sensitive Authentication Data
- PCI SSC, FAQ 1533: storage of sensitive authentication data after authorisation
- PCI SSC, FAQ 1574: storing card verification codes for consumers
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, CVV and CVV2 (Visa)
General information, not legal advice: what applies to you depends on your services and your market.