CVV Digit Test Validation: Format Rules and Limits

Answer first

A CVV holds 3 digits on Visa, Mastercard and Discover cards. American Express uses a 4-digit code. A payment form can count the characters and confirm that each character is a digit. Nothing else is verifiable in the browser. The issuer compares the code to its records during the authorization request and returns a match or a mismatch.

Digit length by network

• Visa: 3 digits, printed on the back signature panel.
• Mastercard: 3 digits, back signature panel.
• Discover: 3 digits, back signature panel.
• American Express: 4 digits, printed on the front above the card number.
• UnionPay: 3 digits on most cards.

Networks use different names for the value: CVV2, CVC2, CID, CAV2. Digit length is the field that matters for form validation.

Checks a form can run

1. Strip spaces and dashes before counting.
2. Reject characters outside 0 through 9.
3. Allow 4 digits when the card number starts with 34 or 37.
4. Set the maxlength attribute to the network value, not to 3 for every card.
5. Keep leading zeros. 007 is a valid code format.

Checks that do not exist

No mod-10 formula, no checksum and no BIN lookup confirms a CVV. A code that passes a format test says nothing about the account behind it. Fraud teams call repeated low-value authorization attempts card testing. Processors score that pattern and block it. A random CVV sent against a live card number produces an authorization request, not a validation result.

The Luhn check applies to the card number

The Luhn formula doubles alternate digits of the primary account number, sums the digits and tests divisibility by 10. Payment forms use it to catch typos in a 16-digit number. It returns nothing useful for a 3-digit or 4-digit CVV. Mixing the two checks in one function creates false failures.

Test values come from the processor

Sandbox environments use fixed card numbers and define their own CVV rules. Stripe test cards accept a 3-digit CVV on most test numbers and use specific values to trigger declines. Other processors publish separate lists. Use the test card table from the processor you integrate. Do not place live card data in a test environment.

PCI DSS blocks CVV storage

PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after authorization. That set includes the CVV, full magnetic stripe data and the PIN block. A form that writes the CVV to an application log, an analytics event or a support ticket puts that system in scope. Mask the field in logs and drop the value after the authorization response returns.

Frequent validation errors

• Hard-coding a 3-digit limit and rejecting Amex cards.
• Casting the field to an integer, which drops leading zeros.
• Trimming the whole field on blur and losing digit position.
• Showing a valid CVV message that reflects format alone.

State the limit in the interface. A label such as 3 digits on the back reduces failed submissions without claiming a check the form cannot run.