Card Verification Value 2 (CVV2, also known as the Visa three-digit code)

Visa continually develops and evolves technologies to help deter fraud. One of these technologies is the three (3)-digit code, which is commonly used as a security tool by merchants who accept Visa® cards for phone and/or online orders to ensure the customer is in possession of a genuine card. Some in-store merchants may also enter the 3-digit code as a security measure to ensure the card is not a counterfeit card.

The 3-digit-code is a security requirement on all Visa cards. It is found on the back of Visa cards, printed at the end of the signature panel (as shown below) or in a white box outside the signature panel (as shown below). The 3-digit code is an important security feature of Visa cards that helps merchants validate the authenticity of the Visa cardholder making the purchase.

Since April 2005, when the merchant submits the 3-digit-code for authentication and the Visa issuer does not participate in the validation, the merchant will be protected against liability for the transaction in the event it is fraudulent.

How does CVV2 work?

After submitting a request for authorization for the card information (account number, card expiration date, and 3-digit-code), the merchant receives a response letting the merchant know whether the 3-digit-code is matched or mismatched, allowing the merchant to take appropriate action.

Regardless of the 3-digit-code verification response, if the issuer does not approve the authorization request, the merchant should not complete the transaction.

How is the 3-digit code beneficial in a card-not-present environment?

The 3-digit-code enables merchants operating in an online or phone environment to verify that the customer is in physical possession of a genuine card. Visa issuers provide a real-time check of the 3-digit-code to help merchants verify that the person making the purchase physically has the card in hand. If a purchaser can only provide the merchant with the 16-digit credit card number and the expiry date, this means that the purchaser likely does not have actual physical possession of the card, signalling a potentially fraudulent transaction.

If the merchant submits the 3-digit-code for authentication and the issuer does not participate in the validation, the merchant will be protected against liability for any potential fraudulent transactions.

For more information on how you can start using the Visa 3-digit-code in your business, speak to your Visa Acquirer/Payment Processor.

Credit Card Image

Back to topBack to top
Tools & Downloads