CVC/CVV
The CVC (Card Verification Code) — also called CVV (Card Verification Value), CID, or CSC — is a security code on the back of Visa and Mastercard cards (3 digits) or on the front of American Express cards (4 digits). It serves as an additional security measure for online payments to confirm that the person paying has physical access to the card.
The CVC is requested during card-not-present transactions (online, telephone), but not for physical payments at the terminal. It is not stored on the magnetic stripe or chip, which is why it is not compromised in data thefts from POS systems.
Important: In accordance with PCI-DSS guidelines, merchants are not allowed to store the CVC. It is only transmitted at the time of the transaction and discarded thereafter. Tokenised payments (e.g. stored cards for recurring payments) only require the CVC for the first transaction.
CVC/CVV examples
A customer enters their card number, expiration date, and the 3-digit CVC on the back of their Visa card during an online purchase.
A payment service provider tokenises the card details during the first purchase. For subsequent purchases, the CVC is no longer requested, as the card is already verified and tokenised.
A merchant requests the CVC but does not store it — as required by the PCI-DSS guidelines.
CVC/CVV FAQ
What is the CVC or CVV on your card?
The CVC (Card Verification Code) or CVV (Card Verification Value) is a 3- or 4-digit security code on your credit or debit card. It is requested during online payments to confirm that you have physical access to the card.
Where do you find the CVC on your card?
For Visa and Mastercard, the 3-digit CVC is located on the back of the card in the signature field. For American Express, the 4-digit CID is on the front, on the right above the card number.
Are merchants allowed to store the CVC?
No. According to PCI-DSS guidelines, merchants are not allowed to store the CVC — neither digitally nor physically. It is only transmitted at the time of the transaction and discarded afterwards.
Why is your CVC requested during online payments?
The CVC serves as proof that you have physical access to the card. It is not stored on the magnetic stripe and therefore protects against fraud involving stolen card numbers.
