Short answer
A 3-digit CVV check confirms that the security code entered at checkout is exactly three digits and, in a live transaction, that it matches the code the issuer has on file. Visa, Mastercard, and Discover print a three-digit code on the back of the card. American Express prints a four-digit code on the front, so an Amex card fails a strict three-digit rule. A format check tests the shape of the input. A real check sends the code to the issuer through your payment processor and reads the result.
What the three digits are
The code is a card-not-present security feature. The issuer generates it and ties it to the account. It is not the card PIN, and a merchant cannot compute it from the card number. That is the point: someone who copies a card number alone does not have the code.
3-Digit CVV Security Test: What It Checks and Why It Matters
Format check vs. issuer check
Format check
The field accepts digits only, rejects non-numeric characters, and enforces a length of three. This stops typos and malformed input before you contact the processor. It proves nothing about the card.
Issuer check
You pass the code with the card number and expiry in the authorization request. The processor returns a result code: match, no match, or not verified. Only the issuer can answer, and only at the moment of authorization.
How to run a 3-digit CVV check at checkout
- Label the field with the name the card network uses, such as CVV2, CVC2, or CID, so customers know which code to enter.
- Set the input to numeric keypad on mobile and cap it at three characters.
- Reject any entry that is not a digit, and reject a length other than three.
- Send the code to your processor inside the authorization request. Never log it and never write it to a database.
- Read the response code and treat a mismatch as a decline for that attempt.
- Clear the code from memory as soon as the response returns.
What a failed check means
- A length or character failure is an input error. Ask the customer to re-enter the code.
- An issuer mismatch is a decline. The code does not belong to that card number.
- A not-verified result usually means the issuer does not participate in the check for that card type.
Storage rules you cannot skip
The CVV is sensitive authentication data under PCI DSS. It must not be stored after authorization, even in encrypted form. Do not accept it by email, do not put it on a paper order form, and do not include it in a call recording. A three-digit field that gets saved is a compliance failure, not a convenience.
Legal note
Card security codes exist to stop unauthorized charges. Buying, selling, or trading card numbers with their security codes is card fraud under 18 U.S.C. 1029 in the United States and equivalent statutes elsewhere. Legitimate work with CVV fields is confined to payment forms and processor integrations you are authorized to operate.