Payments
CVV / CVC (card security code)
Updated
The CVV or CVC is the three- or four-digit security code printed on a card, which the bank checks to show the buyer has the physical card.
The card security code, also called CVC, CVV or CVV2, is printed on the card and is not part of the magnetic stripe or the card number, so a stolen list of card numbers usually does not include it.
When a checkout collects the code, the issuer verifies it during authorisation. Businesses are not allowed to store it, which Stripe points out is why fraudsters rarely obtain it from a data breach. A failed check is a strong sign the buyer does not have the card.
The check has limits. It does not stop someone holding a stolen physical card, and it is not run on payments where no code is entered, such as saved-card renewals and many wallet payments. Visa lists N7 (decline for CVV2 failure) among its data quality decline codes.
Frequently asked questions
- Can a store save my CVV?
- No. Card rules forbid storing the security code after authorisation, which is why saved-card payments are made without it.
- What happens if the CVC is wrong?
- The issuer usually declines the payment, or approves it with a failed check result that the merchant's fraud rules can block. Stripe reports it as incorrect_cvc.