Card Verification Code (CVC)/Card Verification Value (CVV)
Also: Card Verification Code, CVV2, CVC2, CID, CAV2
PCIComplianceHubLast updated
A three or four-digit value carried by a payment card and used to check that the card itself is in the hands of the person making the transaction. Two different values share the name. CVV1 (CVC1) is encoded in the magnetic stripe and validates card-present transactions. CVV2 (CVC2), called CID by American Express and Discover and CAV2 by JCB, is printed on the signature panel or card face and is used for card-not-present transactions such as e-commerce and MOTO. Both are Sensitive Authentication Data, so PCI DSS prohibits storing either after authorization, even in encrypted form.
Applies to. 3.3.1.2 applies to any merchant or service provider that receives the code, and it is aimed at the printed value a customer types or reads out: the CVV2, CVC2, CID or CAV2. The requirement is that the code is not stored once the authorisation process has completed, and its testing procedure has the assessor examine data sources, so the rule reaches order notes, call recordings, chat transcripts and web server logs as well as the payment database. The stripe-encoded CVV1 is caught separately, as part of full track data.
Example. A furniture retailer takes orders by phone. Staff key the code into the payment application, but the order-management system also saves a copy of the whole order form, including the code, in a free-text notes field. That field breaks 3.3.1.2 even though the card number in the same record is encrypted. The fix is to stop capturing the code outside the payment application and purge the historical records.
Limits. The code is Sensitive Authentication Data, not Cardholder Data, which is why the storage rule has no exception for encrypted copies. 3.3.1.2 is about retention after authorisation completes; holding the code while a transaction is still in flight is a different case, with its own conditions in Requirement 3. Issuers and companies that support issuing services are the only entities with a recognised business need to keep the code, again under separate conditions in Requirement 3. The code is often confused with the PIN, but the PIN is known to the cardholder and never appears on the card.