Card Verification Value (CVV)

What is Card Verification Value (CVV)?
A card verification value (CVV) is a security feature that is present on credit, debit and ATM cards to enable 'card not present' transactions. It is an added security feature to ensure that only the actual physical owner of the card can use it remotely and that someone who has only received the card number and some personal information cannot provide that value without the actual card.

A card verification value may also be known as a Card Verification Number (CVN), Card Verification Data (CVD), Card Security Code (CSC), Verification Code (V-Code), or Card Code Verification (CCV).

The CVV actually has two security codes in bank cards. The first, CVV1, is on track 2 of the card's magnetic stripe. The other, CVV2, is the three or four digit code you can usually find on the back of your credit card to the right of the card number or signature strip. The first code on the magnetic stripe is to verify that the card is actually in the hands of the merchant during a transaction and is accessed by swiping the card at a POS terminal. The second code on the card is for remote transactions where the merchant cannot see the card.

CVV codes are generated by the issuer and calculated by encrypting the bank card number together with the service code and the expiry date and a secret encryption code known only to the issuer. This is then converted to decimal code to create a three or four digit code.

Card issuers require merchants not to store the CVV2 in a transaction database so that it cannot be stolen along with credit card numbers. Virtual payment terminals, payment gateways and ATMs do not store the CVV2, which ensures that anyone who has access to these payment interfaces and thus full access to card numbers, cardholder names and expiration dates still does not have the CVV2.

Unfortunately, this security feature cannot protect against phishing, in which the cardholder unwittingly but willingly passes the CVV2 on to the phisher along with the name, card number and expiry date.