CVV Digit Test Validation Process: How It Works

What CVV Validation Actually Is

CVV validation is an issuer-side check that happens inside a card authorization request. The 3-digit code on the back of a Visa, Mastercard, or Discover card (4 digits on the front of an American Express card) is sent with the transaction, the issuing bank compares it against the value it has on file for that account, and the bank returns a one-letter result code. Nothing is tested locally. No merchant, gateway, or software can calculate a valid CVV from a card number, because the value is not derived from the account number. Verification only succeeds when the number the cardholder typed matches the number the issuer issued.

That distinction matters. The phrase "CVV test" in payment operations refers to reading the issuer's response code, not to running a check on a list of numbers.

Prerequisites

• A merchant account with an acquirer that supports CVV verification in the authorization message.
• A gateway or processor that passes the CVV field through and returns the result code in the response.
• PCI DSS compliance, including never storing the CVV after authorization.

The Validation Flow, Step by Step

1. The cardholder enters the card number, expiration date, and CVV at checkout.
2. The checkout form encrypts the payment fields and transmits them to the gateway over TLS.
3. The gateway builds an authorization request and places the CVV in the designated data field.
4. The acquirer routes the request through the card network to the issuing bank.
5. The issuer compares the submitted CVV against the value stored for that account.
6. The issuer returns an authorization decision plus a CVV result code.
7. The gateway passes both back to the merchant in the response.
8. The merchant's business rules accept, decline, or flag the order based on the decision and the CVV code.

What the Result Codes Mean

• M — CVV matches. The code is correct.
• N — CVV does not match. The value entered is wrong.
• P — Not processed. The issuer did not run the check.
• U — Unknown. The issuer does not support CVV verification or the data was not available.
• S — The card should have had a CVV, but the merchant did not send one.

Rules That Govern the Data

PCI DSS treats the CVV as sensitive authentication data. It may be transmitted to authorize a transaction and must not be stored after authorization, in any form, encrypted or not. Logs, order databases, and customer profiles cannot hold the value. Because of this, a declined CVV can only be corrected by asking the cardholder to re-enter the code on a fresh authorization. Repeated re-submissions of the same card with varying codes is a card-testing pattern that processors monitor and that issuers respond to with blocks.

Why a CVV Check Fails

• A typo or an extra space in the code field.
• Entering the card's expiration date or ZIP in the CVV field.
• Sending three digits for an American Express card, which uses four.
• A virtual or tokenized card that has no printed CVV.
• An issuer outside the network's CVV program, which returns a U code.
• A cardholder reading a security code from a different card in their wallet.

Merchants typically pair the CVV result with Address Verification Service data and the authorization decision to set a risk threshold, and they treat a missing or mismatched code as a reason to hold the order for review rather than to ship it.