CVC/CVV
The CVC (Card Verification Code) or CVV (Card Verification Value) is a 3- or 4-digit security code on credit and debit cards, which is used for verification during online payments.
CVC/CVV
The CVC (Card Verification Code) — also known as CVV (Card Verification Value), CID, or CSC — is a security code on the back of Visa and Mastercard cards (3 digits) or on the front of American Express cards (4 digits). It serves as an additional security measure for online payments to confirm that you have physical access to the card.
The CVC is requested for Card-Not-Present transactions (online, telephone), but not for physical payments at the terminal. It is not stored on the magnetic stripe or chip, which is why it is not compromised in the event of data theft from POS systems.
Important: Under PCI DSS guidelines, merchants are not allowed to store the CVC. It is only transmitted at the time of the transaction and then discarded. Tokenised payments (e.g. saved cards for recurring payments) only require the CVC for the first transaction.
CVC/CVV examples
A customer enters their card number, expiration date and the 3-digit CVC on the back of their Visa card during an online purchase.
A payment service provider tokenises the card data during the first purchase. For subsequent purchases, the CVC is no longer requested, as the card is already verified and tokenised.
A merchant requests the CVC but does not store it — as required by PCI-DSS guidelines.
CVC/CVV FAQ
What is the CVC or CVV on your card?
The CVC (Card Verification Code) or CVV (Card Verification Value) is a 3- or 4-digit security code on your credit or debit card. It is requested during online payments to confirm that you have physical access to the card.
Where can you find the CVC on your card?
For Visa and Mastercard, the 3-digit CVC is on the back in the signature field. For American Express, the 4-digit CID is on the front, on the right above the card number.
Are merchants allowed to store the CVC?
No. According to PCI-DSS guidelines, merchants are not allowed to store the CVC — neither digitally nor physically. It is only transmitted at the time of the transaction and discarded afterwards.
Why are you asked to provide your CVC for online payments?
The CVC serves as proof that you have physical access to the card. It is not stored on the magnetic stripe and therefore protects against fraud with stolen card numbers.
