CVV transaction checks verify the card verification value during card-not-present payments to help confirm that the buyer has access to the physical card. They are one fraud-risk signal, not proof of identity, and they must be handled under PCI DSS rules.
What a CVV transaction check does
A CVV transaction check compares the three- or four-digit code printed on the card with the issuer's record during authorization. The issuer or payment network returns a result such as a match, no match, or not processed. Merchants use that result alongside address verification, 3-D Secure, velocity checks, and device data. No single check proves that a card is safe to accept.
Where CVV checks fit in the authorization flow
- The customer enters card details on a PCI-compliant payment page.
- The payment gateway sends the authorization request, including the CVV, to the issuer.
- The issuer checks the CVV against its records and returns a response code.
- The merchant applies its risk rules to the CVV result and other signals.
- The merchant approves, declines, or sends the order for manual review.
What CVV checks cannot tell you
CVV transaction checks do not prove that the person entering the code is the cardholder. They also do not stop fraud when stolen card data includes the CVV, and they do not replace chargeback controls or order screening. A match only shows that the code was correct at the time of the request.
Operational rules for handling CVV data
- Do not store the CVV after authorization.
- Do not write CVV values to logs, notes, or customer records.
- Limit access to payment systems that process sensitive authentication data.
- Use PCI-validated payment pages and gateways.
- Train support staff not to request CVVs by email, chat, or phone.
How merchants use CVV results
Merchants usually treat a CVV mismatch as a risk signal, not an automatic fraud verdict. High-value orders, new customers, and unusual shipping patterns may need extra review. Clear decline reasons and consistent review rules help reduce false declines while keeping CVV transaction checks useful.