What is a CVV? A merchant's guide to card security codes

A CVV is the security code printed on a payment card, and the letters stand for card verification value. Discover describes it as a three- or four-digit number found on a credit card, typically on the back near the signature panel, while American Express prints a four-digit code on the front. When a customer buys online or reads their card to you over the phone, the CVV is how you check that they hold the card and not only the number.

For a merchant, the CVV raises three practical questions: how to ask for it, what to do when it doesn't match, and why you can never keep it. This guide answers all three, with the card network and PCI rules behind each answer, as of October 2026.

What does CVV stand for, and what do the card brands call it?

Every major brand prints a version of the code, but each one names it a little differently, which is why most checkout forms just say "security code." The check works the same way whatever the label says.

Sources: Visa's dispute management guidelines, Mastercard's Security Rules and Procedures, and Discover's explainer.

American Express lists more aliases in its own guide to the CVV, including CSC (card security code), CID (card identification number), and CVC. Your staff doesn't need to memorize any of that. If a customer asks which number you want, the answer is the three digits on the back, or the four on the front of an Amex.

One thing the CVV isn't: a PIN. A PIN is something the cardholder knows and types on a PIN pad. The CVV is printed on the card, so anyone holding the card, or a photo of it, can read it. That limit matters later in this guide.

How does a CVV check work on online and phone orders?

A CVV check rides along with the authorization request. You collect the code, your gateway sends it with the card number and amount, and the card issuer compares it with what it has on file. The result comes back in the same response as the approval or decline.

1. The customer types the card number, expiry date, and CVV into your checkout, or reads them to you over the phone.
2. Your gateway or virtual terminal sends everything to your processor in the authorization request.
3. The issuer compares the code with its records and returns a CVV result alongside its approve or decline decision.
4. Your gateway applies your fraud rules to that result, for example declining when the code doesn't match.
5. The code is thrown away. You keep the authorization result, never the CVV itself.

Step 3 hides a catch that surprises a lot of merchants. The CVV result and the approval are two separate answers, and an issuer can approve a sale even when the code was wrong. Visa's dispute rules deal with exactly that case, covered in the chargeback section below. So check your gateway settings instead of assuming a bad code means an automatic decline.

Why bother at all? Because card-not-present sales are where card fraud moved once chip cards spread. The Federal Reserve found that by 2016, remote payments accounted for 61.1% of card fraud by value. A CVV check is one of the cheapest filters you have against a stolen card number, and our guide to card-not-present transactions covers the rest of the toolkit.

What does a CVV mismatch mean?

A mismatch means the issuer checked the code and it didn't agree with its records. Sometimes that's a typo. Sometimes it's a person holding a stolen card number without the card. Visa's developer documentation spells out the two basic results: an M means Visa or the issuer was able to verify the CVV2 value provided by the merchant and it matched, and an N means it was verified and did not match.

You'll see a third answer, too. A U result means the issuer couldn't run the check or doesn't support it, and Visa's merchant acceptance guide treats a U differently from a no-match when a fraud dispute comes in. Gateways often show more codes than these, so ask yours for its full list.

Here's how we'd set the defaults for a typical small online store. Treat them as a starting point and adjust them to your margins and fraud history.

Patterns matter more than single results. One mismatch from a returning customer is usually fat fingers. Six mismatches in ten minutes on six different card numbers is a bot testing stolen cards, and that's what velocity rules are for. Clearo's online payments include fraud screening with AVS, CVV checks, and velocity rules that cap repeated attempts.

A worked example

Say an online sneaker shop in Miami gets a $180 order. The CVV comes back N, but the issuer approves the sale anyway, and the shop's gateway is set to accept every approval.

• If the order is fraud and the shop ships it, the $180 comes back out of its account when the chargeback lands.
• The sneakers are gone too. If they cost the shop $90, that one order costs $270, before any chargeback fee its provider charges.
• If the shop had voided the authorization and asked the buyer to re-enter the code, the worst case was a lost sale, and a real customer with a typo would simply have tried again.

That's the whole argument for declining on N by default.

Why can't merchants store the CVV?

Because PCI DSS says so, with no exception for small businesses. The standard treats card verification codes as sensitive authentication data, and the PCI Security Standards Council lists them, along with full track data and PIN block data, as data you may not store after authorization. Our guide to what PCI compliance is explains the rest of the standard.

The logic is easy to follow. If stores kept codes, one breached database would hand criminals everything they need to shop online. Since nobody may keep them, a stolen list of card numbers is worth less. Our PCI compliance page puts never keeping the code on its short list of ways to shrink your PCI scope.

"Never stored" reaches further than most owners expect. All of these count:

• The sticky note where someone jotted down a phone order.
• An email or chat where a customer typed out their full card details.
• A spreadsheet of "cards on file" for regulars.
• Paper order forms kept in a drawer after the charge went through.
• Call recordings that capture a customer reading the code aloud.

Recurring billing is no exception. PCI SSC's FAQ on the question says the code isn't needed for card-on-file or recurring transactions, and storing it for those purposes is prohibited. If you bill customers again later, store the card as a token through your payment provider instead. Our guide to payment tokenization shows how that works.

Does a CVV check protect you from chargebacks?

Partly. A match doesn't stop a fraud chargeback by itself, because a criminal who phished the card details often has the code too. Where the check helps is in the specific cases where card network rules give you room to fight a dispute.

• Visa: if a mail, phone, or e-commerce sale returned a CVV2 result of N with a presence indicator of 1, and the issuer approved it anyway, Visa's dispute management guidelines list that as grounds for your acquirer to respond to a fraud dispute.
• Visa again: if you ran the check and the issuer answered U, Visa's acceptance guide says you have a right to represent the dispute.
• Mastercard: when a merchant's card-not-present fraud passes 100 gross basis points, its rules require the acquirer to act, and for e-commerce that means capturing and sending the CVC 2 value or becoming Mastercard Identity Check enabled.

Our honest take: don't plan your fraud strategy around winning disputes. Representment takes time, and you still have to send evidence and wait. Declining a mismatched order costs you nothing but a few seconds of the customer's patience. For the dispute process itself, see how a chargeback works.

How should you take a CVV over the phone?

Key it straight into a virtual terminal while the customer is still on the line, then let it go. Nothing gets written down, so there's nothing to secure, shred, or forget about.

1. Open the virtual terminal before you ask for any card details.
2. Type the card number, expiry, CVV, and billing ZIP code straight into the form. No paper, no notepad app.
3. If the CVV comes back N, ask the customer to read it once more. If it fails twice, stop and offer another way to pay.
4. Email a receipt instead of reading the card number back.
5. If the customer wants to be billed again later, save the card as a token through your provider, never in your notes or your CRM.

Take a furniture store in Columbus that takes deposits by phone. If the salesperson writes card details on an order pad to key in later, every pad in the back office is a PCI problem. Keying each card live into a virtual terminal, or texting the customer a payment link so they type the code themselves, removes the paper entirely. Our guide to taking card payments on a phone covers the setups.

Do you need the CVV for in-person or recurring payments?

In person, no. When a customer dips or taps, the chip creates a security code that's unique to each transaction, which is a stronger check than a printed number that never changes. Asking for the printed code at a counter adds nothing a chip read hasn't already done. If a chip won't read, work through the fallback steps in our guide to what EMV is instead of keying the card.

For recurring billing, you collect the CVV once, on the first customer-initiated charge, to confirm the card. Every later charge runs on the stored card (ideally a token) without it, which is exactly what the PCI FAQ above expects. Our recurring billing guide covers the consent and disclosure rules that come with storing a card.

Common CVV mistakes merchants make

Most CVV problems are settings or habits, not hacks. Watch for these:

• Leaving the CVV field optional at checkout. If the code isn't sent, you get no result and no protection.
• Reading an approval as a match. Check the CVV result separately, or set your gateway to decline on N.
• Letting the same card retry endlessly. Without velocity limits, a bot can guess codes or test hundreds of numbers.
• Keeping the code "just until the order ships." The rule says never after authorization, and there's no grace period.
• Relying on the CVV alone for big orders. Pair it with the address verification service and, for high-risk orders, 3-D Secure.

When is a CVV check not enough?

When the person ordering has everything printed on the card. Phishing pages, fake customer service calls, and malicious checkout scripts all collect the code along with the number, so a CVV match proves possession of the card details, not identity.

That doesn't make the check weak. It makes it a first layer. Turn it on for every online and phone sale, then decide what goes on top: address verification for physical goods, 3-D Secure for high-value or easily resold items, and a human look at rush orders shipping to a new address. Our guide on preventing chargebacks matches each tool to the dispute it stops.

These rules come from the card networks and PCI SSC, so they work the same way across the United States and in Canada.

Next step

If you're not sure what your checkout does with a CVV mismatch, or whether your fraud tools are costing you good orders, we can help. Send us a recent statement for a free statement review and we'll show you how your online and phone sales are priced, or contact us to walk through your fraud settings with a rep. Clearo also offers PCI compliance support if the storage rules above raised questions.