CVC / CVV (Card Verification Value)

The CVC or CVV is the short security code printed on a card. It is three digits on the back of Visa and Mastercard cards and four on the front of American Express cards. It shows that the person entering the card details has the card, which matters for online payments where the card isn't present.

How the check works

The merchant collects the code and sends it to the issuer, which replies with a match, no match, or not checked. A mismatch is a strong fraud signal, because card numbers stolen in data breaches usually don't include the printed code.

Each network has its own name for the code: CVV2 (Visa), CVC2 (Mastercard), and CID (American Express). In Stripe, the result is in payment_method_details.card.checks.cvc_check on the charge, with values such as pass, fail, or unavailable.

Why it matters

• Together with AVS, the code check stops many payments made with stolen numbers.
• Bots running card testing attacks often can't supply a valid code, so a spike in CVC failures is an early warning.
• PCI DSS forbids storing the code after authorization, even encrypted.

Because the code is never stored, a card saved with tokenization doesn't keep it. Charges on a saved card skip the CVC check unless the merchant asks for the code again.

In practice

A failed CVC check doesn't always block the payment. The issuer decides whether to approve. Merchants and fraud tools weigh the CVC result with the amount, the AVS result, and a risk score to accept, challenge, or decline the payment.