Short answer

A CVV digit test checks the format of the card verification value: digit count and character type. Visa, Mastercard, Discover, and UnionPay use 3 digits. American Express uses 4 digits. A format test does not prove the code is valid. Only the issuer can confirm a match.

Digit counts by network

  • Visa: 3 digits, printed on the back, called CVV2.
  • Mastercard: 3 digits, printed on the back, called CVC2.
  • American Express: 4 digits, printed on the front, called CID.
  • Discover: 3 digits, printed on the back, called CID.

Some UnionPay cards also print 3 digits. A small number of issuers use other layouts. If the printed panel does not match the input field, the form rejects the entry.

What validation code checks

A payment form runs three checks: digits only, exact length for the card network, and no spaces or dashes. A leading zero is a valid digit. Strip whitespace before the length check, or a correct code fails.

Length rules follow the card number prefix. An American Express number starts with 34 or 37 and needs a 4-digit field. A Visa number needs a 3-digit field. A form with one fixed 3-digit field rejects every American Express card.

Sandbox test values

Payment processors publish test card numbers for test mode. Test mode returns simulated responses. It does not contact an issuer and does not move money. Some gateways accept any code that passes the length check in test mode. Others require a documented value to trigger a set response code. Test values work only in test mode. Live mode rejects them or returns a mismatch.

Decline codes vs format errors

A format error blocks the request before it leaves the page. A mismatch is an issuer response. Common issuer codes include CVV failure, meaning the code does not match the record, and no-CVV, meaning the issuer does not take part in the check. A mismatch is not a format bug.

Storage rules

PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after authorization. That set includes the full track, the CVV, and the PIN block. A database column for CVV violates the standard. Merchants that keep it carry the risk.

Legal note

A CVV belongs to the account holder. Entering a CVV that is not yours is card fraud. Buying CVVs from a third party is illegal in the US under 18 U.S.C. 1029. This page covers format rules and test-mode behavior only.