CVV Digit Verification Test: Format Check Guide

What a CVV digit verification test checks

A CVV digit verification test confirms that your payment form accepts the correct number of digits in the card security code field and rejects every other input. It is a format check, not a validity check. Your gateway decides whether the code matches the issuer's record. Your form only decides whether the user typed something that could be correct.

Run every test with sandbox test cards. Real card numbers and real security codes do not belong in a staging environment, and PCI DSS bars you from storing the code after authorization.

Prerequisites

• A sandbox or staging account with your payment processor
• The processor's published test card numbers, including one American Express number
• Browser developer tools open on the Network and Console tabs
• Access to application logs and the database read replica

How to run the test

1. Open the sandbox checkout page in a staging environment.
2. Enter a test card number that uses a 3-digit code, such as a Visa or Mastercard test number.
3. Type a valid 3-digit code and submit the form.
4. Confirm the gateway returns a successful authorization or an expected decline code, not a form error.
5. Repeat the submit with a 2-digit entry and confirm the form blocks it before the request leaves the browser.
6. Repeat with a 5-digit entry, letters, a space, and an empty field, and confirm each one is blocked.
7. Switch to an American Express test number and confirm the field now accepts 4 digits and rejects 3.
8. Open the Network tab and inspect the request payload to confirm the code travels over TLS to the tokenization endpoint.
9. Search your application logs and database tables for the code value and confirm no match exists.
10. Reload the page after a failed submit and confirm the field is empty and not autofilled from saved storage.
11. Record the pass and fail result for each case against the build number.

Cases that must pass and must fail

• Pass: 3 digits on a Visa, Mastercard, or Discover test card
• Pass: 4 digits on an American Express test card
• Fail: 1 or 2 digits
• Fail: 5 or more digits on a 3-digit card
• Fail: letters, symbols, or pasted whitespace
• Fail: empty field on submit

Mistakes that break the test

• Hardcoding a 3-digit limit for every card brand instead of reading the brand from the card number
• Trimming the input in the browser but storing the raw value in the session
• Logging the full request body, which captures the code in plain text
• Testing in production with a live card because the sandbox behaved differently

When a case fails, fix the client-side rule, the server-side rule, and the logging policy together. A form that validates the length but writes the code to a log still fails the audit.