Mastercard CVV Verification Procedure: How CVC2 Works

What is the Mastercard CVV verification procedure?

The Mastercard CVV verification procedure is a fraud check used when the card is not present at the point of sale. The customer supplies the three-digit card verification code printed on the back of the card, that code travels inside the authorization message, and the card issuer confirms it matches the value on its own records. A match lets the charge move forward; a mismatch returns a decline or a fraud flag.

The check is one layer among several. Issuers also run address verification, purchase velocity checks, and device fingerprinting on the same transaction.

What the code actually is

Mastercard prints a three-digit code in the signature panel on the back of every consumer card. It is created at the moment of card production and tied to the card number, expiration date, and service code through an encryption key held by the issuer.

The code is not a password and not a PIN. It does not appear on receipts, statements, or a merchant's stored customer record.

The three Mastercard verification codes

CVC2: the three digits on the back

CVC2 is the value used for online and phone orders. It sits to the right of the signature strip and is printed flat, not embossed.

CVC1: the code inside the magnetic stripe

CVC1 is encoded in the stripe and read by a terminal when the card is swiped. A copied stripe without a matching CVC1 fails the check at the terminal level, which is why cloned cards decline even when the printed number looks correct.

CVC3: the dynamic chip code

CVC3 is generated by the chip for a single transaction and changes every time the card is used. It cannot be reused because the next purchase expects a new value.

How the verification runs, step by step

1. The cardholder enters the card number, expiration date, and CVC2 at checkout.
2. The payment gateway encrypts the data and forwards it to the acquirer.
3. The acquirer sends an authorization request into the Mastercard network.
4. Mastercard routes the request to the issuing bank that holds the account.
5. The issuer compares the submitted CVC2 against its stored value and applies its own fraud rules.
6. The issuer returns an approval, a decline, or a specific CVV failure response code.
7. The merchant captures the approved amount. The code itself is discarded.

The full exchange takes under two seconds in most cases, and no stored copy of the code survives it.

What merchants are allowed to keep

PCI DSS Requirement 3.2 bars storage of sensitive authentication data after authorization. That covers the full magnetic stripe contents, the CVC2 value, and the PIN block.

• Merchants may store the card number, expiration date, and cardholder name if they protect that data.
• They may not store CVC1, CVC2, or CVC3 in any form, including hashed or encrypted form.
• Subscriptions and stored-card billing rely on a token from the processor, never on a saved CVV.

A merchant that keeps CVV data after a sale is out of compliance and carries liability for any breach that follows.

Why a CVV check fails

• The customer mistyped a digit or read the code from the wrong side of the card.
• The card was replaced and the new plastic carries a different CVC2.
• The card product does not take part in code validation, which happens with some commercial and prepaid products.
• The issuer declined for unrelated reasons (billing address mismatch, risk score, frozen account) and returned a generic error.
• The merchant sent a token where the code was never collected, so the issuer had nothing to compare.

Is buying or selling CVVs legal?

No. A CVV is not merchandise, and nobody holds the right to sell one. Codes offered through so-called CVV shops come from stolen card data, and trafficking in that data is access device fraud under 18 U.S.C. § 1029 in the United States. Buyers carry the same exposure as sellers, because using someone else's card data to obtain goods or cash is identity theft and wire fraud. Penalties include prison time and restitution.

There is a second problem with that market: it runs on scams. Sellers who advertise valid codes take payment and deliver nothing, or deliver numbers that were cancelled months ago. There is no refund process, no consumer protection, and no way to file a complaint without admitting to a crime.

If someone asks you to read your own code back over a text, an email, or a phone call, that is a phishing attempt. No bank, processor, or delivery company needs the three digits.

Common questions about CVC2

Does the CVC2 change when a card is replaced?

Yes. New plastic is produced with a new code, even when the account number stays the same. Saved card details at a merchant will fail until the customer updates them.

Is the CVV the same as the PIN?

No. The PIN authorizes a transaction at an ATM or terminal with the card present. The CVV shows that the person using the card data has seen the physical card.

Can a merchant ask for the CVV by email?

They should not, and PCI DSS treats email as an insecure channel for card data. Legitimate checkouts collect the code inside an encrypted payment page.

How to protect your own CVV

• Cover the back of the card when you hand it to anyone.
• Never read the code aloud in a store, on a call, or in a chat.
• Check your statements each month for charges you do not recognize.
• Report a lost card to the issuer at once so the code retires with the account.