What is CVV?

CVV stands for Card Verification Value. This number is vital for completing online transactions and should never be shared with anyone. The CVV number is generated by debit card issuers (banks or other financial institutions) based on the following details:

A CVV is the three- or four-digit number on your card that adds an extra layer of security when making purchases online or over the phone. It serves to verify that you have a physical copy of the card in your possession and helps protect you if your card number falls into the hands of hackers and identity thieves.

How do I locate the CVV in a debit card?

Locating the CVV is simple. It is the three-digit number at the back of your debit card. For certain types of debit cards, it could be a four-digit number printed on the front.

What is the purpose of the CVV?

CVV is to debit card what a security guard is to an establishment. It helps safeguard your debit card against theft, fraud or unauthorised transactions. The CVV ensures that only the card owner uses the card. Even if someone gets hold of the debit card number, they cannot transact without the CVV

What is CVV in ATM?

Card verification value (CVV) is a combination of many features used in Debit Cards for the purpose of establishing your identity. This helps in minimising the risk of theft and fraud. You might also know CVV by other names, like card verification code (CVC) or card security code (CSC).

How do CVVs protect against fraud?

CVV codes are designed to prevent fraud during card-not-present (CNP) transactions. When a merchant requests a CVV number, it ensures that the customer physically has the card in their possession. When a payment is being made online or over the phone, collecting a CVV code is critical. It prevents identity thieves from being able to carry out a transaction. Without the card in their possession, they will not be able to provide the CVV code to the merchant.  Sometimes, these codes are also used for card present transactions, to prevent fraudulent employees or merchants from capturing card details when accepting payments and using them later on.

According to global PCI DSS standards, it is forbidden for merchants to store CVV numbers. Doing so can result in hefty fines or cancellation of merchant facilities by the acquirer or payment processor. These standards increase the protective power of the CVV code, ensuring it doesn’t get into the wrong hands.

Can transactions be authorized without a CVV number?

CVV numbers are not required for credit card processing – they are simply an extra security measure. Because of this, some online merchants choose not to capture CVV codes for fear of reducing conversions.

This is a mistake, as CVV codes are an important line of defense against fraud. There are some payment types that require a CVV code for one-off payments. For a recurring payment, it will only be required for the first payment in the series.

Here are the steps a merchant takes when processing a card-not-present transaction with a CVV code:

1. The merchant captures credit card information from the customer. At this stage, they can choose whether or not to request the CVV code. If they do, they usually refer to it as ‘the last three digits on the back of the card’, which is a more commonly known reference than ‘CVV’.
2. The merchant sends the card details, including the card number, expiration date, cardholder name and address, and optionally the CVV code, to the acquiring bank, for authorization. Together with the authorization request, the merchant adds a CVV indicator – a number indicating whether or not a CVV code is being included. The CVV number is not stored by the merchant.
3. The acquirer sends the authorization request to the credit card association (Visa, MasterCard, American Express etc.).
4. The credit card association sends the request to the card issuer.
5. The card issuer decides whether to approve or decline the transaction, sending back the response in the same way it arrived— through the credit card association and acquirer, and then back to the merchant. If a CVV code was included, a CVV response code will be returned, detailing whether or not the CVV code was a match. If it was not a match, or if it was missing, the merchant can decide whether or not to proceed with the transaction.

CVV codes are a first step towards mitigating the risk of online fraud. For CNP transactions, capturing a CVV code is the best way to confirm that the customer has the card in their possession, thus reducing the risk of fraudulent transactions using stolen card information.