Card Verification Code (CVC/CVV)

The CVC/CVV is the short security code printed on a card, used to confirm the cardholder actually has the card in hand during a transaction, particularly for card-not-present payments. It's one of the simplest, most widely recognised fraud checks in payments, asking nothing more of the customer than a glance at their own card, yet it plays a real role in protecting merchants and cardholders from certain types of stolen-card fraud. Familiar as it is, the rules around how CVV can be collected, used and stored are strict, and worth actually understanding.

What the Code Actually Is

Called CVV, CVC or CVC2 depending on the network, this 3 or 4-digit code sits on the card itself but isn't stored in the magnetic stripe or chip data, meaning only someone who's physically seen the card can provide it. That makes it a useful, low-friction check against certain kinds of card fraud.

What Happens the Moment It Gets Entered

Type the CVC/CVV at checkout, and it goes to the issuer as part of the authorisation request, alongside card number and expiry date. The issuer checks it against its own records and sends back a match result, which merchants weigh alongside other signals to judge whether the transaction is likely genuine.

Why This Small Code Actually Helps

Since it's not stored on the chip or stripe, and merchants are prohibited from storing it after authorisation, it can help protect against certain types of fraud involving stolen physical cards or compromised terminals, though it is not a complete safeguard on its own.

It Works Best as Part of a Layer, Not Alone

CVV checks earn their keep alongside other signals, AVS and 3D Secure especially, rather than standing on their own. finera.'s payment gateway supports configurable rules for handling CVV mismatches as part of a layered intelligent fraud management strategy.

The Misconception Worth Clearing Up

People assume CVV alone proves a transaction is genuine. It doesn't. It's one signal among several, and merchants aren't permitted to store it after authorisation under PCI DSS, which is exactly why it needs re-entering for every new transaction rather than saved alongside a card on file.

Recurring Payments Handle This Differently

For subscriptions and other recurring charges, merchants typically capture CVV only on the very first transaction, then lean on the card network's stored credential framework, not the CVV itself, to authorise everything after. That keeps recurring billing compliant with PCI DSS while still letting renewal payments go through without repeated manual entry.

Why CVV Alone Was Never Meant to Carry the Whole Job

CVV was designed decades ago as one small piece of a much bigger fraud prevention puzzle, not a complete solution on its own. Modern fraud prevention treats it exactly that way, as a single, useful data point sitting inside a far more sophisticated risk assessment.