CVC/CVV
The CVC (Card Verification Code) or CVV (Card Verification Value) is a 3- or 4-digit security code on credit and debit cards, which is used for verification during online payments.
CVC/CVV
The CVC (Card Verification Code) — also known as CVV (Card Verification Value), CID or CSC — is a security code on the back of Visa and Mastercard cards (3 digits) or on the front of American Express cards (4 digits). It serves as an additional security measure for online payments to confirm that the person paying has physical access to the card.
The CVC is requested during card-not-present transactions (online, telephone), but not for physical payments at the terminal. It is not stored on the magnetic stripe or chip, which is why it is not compromised in the event of data theft from POS systems.
Important: Comerciantes are not permitted to store the CVC in accordance with PCI DSS guidelines. It is only transmitted at the time of the transaction and is subsequently discarded. Tokenised payments (e.g. stored cards for recurring payments) only require the CVC for the first transaction.
CVC/CVV examples
A customer enters their card number, expiry date and the 3-digit CVC on the back of their Visa card during an online purchase.
A payment service provider tokenises the card details during the first purchase. For subsequent purchases, the CVC is no longer requested, as the card is already verified and tokenised.
A Comerciante requests the CVC, but does not store it — as prescribed by the PCI DSS guidelines.
CVC/CVV FAQ
What is the CVC or CVV on my card?
The CVC (Card Verification Code) or CVV (Card Verification Value) is a 3- or 4-digit security code on your credit or debit card. It is requested during online payments to confirm that you have physical access to the card.
Where do I find the CVC on my card?
For Visa and Mastercard, the 3-digit CVC is located on the back in the signature field. For American Express, the 4-digit CID is on the front, on the right above the card number.
Are Comerciantes allowed to store the CVC?
No. According to PCI DSS guidelines, Comerciantes are not allowed to store the CVC — neither digitally nor physically. It is only transmitted at the time of the transaction and discarded afterwards.
Why is my CVC requested for online payments?
The CVC serves as proof that you have physical access to the card. It is not stored on the magnetic stripe and therefore protects against fraud with stolen card numbers.
