CVV, CVC, CID and CVV2: What the Card Security Code Actually Means
Few things in payments generate more confusion than the three-letter code on the back of a card. Is it CVV, CVC, CVV2 or CID? Does it go on the front for Amex? Can you store it? This article clears up the terminology and the rules that matter for developers.
Four names, one idea
The security code is a short number that is not encoded in the magnetic stripe or the EMV chip. Its job is to prove that the person paying is physically holding the card, which makes it valuable for card-not-present (CNP) transactions.
| Term | Stands for | Used by | Length | Position |
|---|---|---|---|---|
| CVV | Card Verification Value | Visa | 3 digits | Back |
| CVV2 | Card Verification Value 2 | Visa (card-not-present) | 3 digits | Back |
| CVC | Card Verification Code | Mastercard | 3 digits | Back |
| CVC2 | Card Verification Code 2 | Mastercard (CNP) | 3 digits | Back |
| CID | Card Identification Number | American Express | 4 digits | Front |
| CVV / CAV2 | Card Authentication Value | JCB | 3 digits | Back |
| CSC | Card Security Code | Discover | 3 digits | Back |
The distinction between CVV and CVV2 (or CVC and CVC2) is historical: the "2" suffix refers to the card-not-present usage of the same value. In day-to-day development, "CVV" is used as a generic name for the field across all networks.
The two things that actually matter in code:
- Amex uses 4 digits on the front — any input field that forces 3 digits will fail Amex tests.
- The full value is sensitive cardholder data, so it is covered by PCI DSS.
The PCI DSS rules you cannot ignore
The CVV is classified as sensitive authentication data. Under PCI DSS:
- You may use it to process a transaction.
- You may not store it after authorization — not in logs, not in a database, not in an analytics event, not in a support screenshot.
- You may not store it even if encrypted. The prohibition is absolute.
- You should not render it back to users after submission.
In practice this means:
- Never log request payloads that contain
cvv,cvc,cidorsecurity_code. - Mark the field as sensitive in your observability tooling and scrub it at the edge.
- When providers return a verification result, store the result (
cvv_check: pass/fail/unchecked), never the value itself. - Keep the CVV field out of your own API if the browser can send it directly to the gateway's tokenization endpoint.
How CVV checks behave in practice
A CVV check is a separate authorization signal, not a hard gate. Different issuers and gateways handle a mismatch differently:
- Some decline the transaction outright.
- Some approve it and return a
CVC mismatchcode, letting the merchant decide. - Some are configured to skip the check entirely in certain regions.
You can test this deliberately: Stripe's 4000 0000 0000 0127 always returns an incorrect-CVC response, which is ideal for exercising your error handling without touching a real card. See the full test card list for more.
Generating test CVVs
For sandbox work, any 3 digits (or 4 for Amex) are accepted by most gateways. Our card generator can attach a random or fixed CVV to every generated number, and output the result in a pipe-separated format that is easy to parse into fixtures:
4242424242424242|12|2030|123
If you need to generate numbers for a specific issuer range, the advanced generator accepts wildcard patterns, and the BIN checker tells you which network a prefix belongs to.
Summary
- CVV, CVC, CID, CVV2 and CSC all describe the same idea with network-specific names.
- Amex is the exception: 4 digits, printed on the front.
- Never store the code after authorization — PCI DSS treats it as sensitive authentication data.
- Treat a CVV mismatch as a configurable outcome, and test both the decline and the soft-fail path.