CVV (card verification value)
explained.

How the CVV check works

1. The customer types the code at checkout.
2. Your processor sends it with the authorization request.
3. The issuer compares it and returns a result: match, no match, or not checked/unavailable.
4. Your processor or fraud rules decide whether to block a failed check. Stripe, for example, lets you block payments that fail the issuer's CVC check through a Radar rule.

Stripe notes some payments don't use CVV at all, such as wallets like Apple Pay and off-session payments using a saved card.

The storage rule

The PCI Security Standards Council's FAQ says merchants may request card verification codes for card-not-present transactions, but they are collected only when needed for authorization and never stored afterwards. Card verification codes are sensitive authentication data, and PCI DSS Requirement 3.3.1.2 prohibits storing them after authorization, even encrypted. That is why recurring and one-click payments run without a CVV.

What CVV does and doesn't prove

• Does: indicates the payer had the card, or a complete set of its details.
• Doesn't: prove the payer is the cardholder. Stripe notes CVV verification does not protect against physical card theft or against details captured by insecure websites or computers.
• In disputes: a CVV match is supporting evidence in fraud disputes alongside AVS, 3-D Secure and customer history. American Express lists, among responses to an F29 chargeback, proof that you attempted to validate the CID and received no response or an "unchecked" response.

CVV and card testing

Because CVV can't be stored, fraudsters try to guess it. Visa describes enumeration attacks in which bots run automated transactions to guess the full card number, CVV2 and expiry date. A wave of CVV mismatches on small orders is a classic sign of card testing.

A worked example

A store normally sees about 2 CVV mismatches a day. One night it logs 400 failed authorizations in an hour, mostly $1 to $5 attempts with random names and the same few BINs. That is not 400 forgetful customers; it is a bot enumerating CVV codes. The right response is CAPTCHA and rate limits on checkout, not just blocking each card.

Common mistakes

• Storing the CVV in order notes, support tickets or logs. It is a PCI DSS violation.
• Treating a match as proof of identity.
• Retrying a mismatched card repeatedly, which looks like card testing to issuers.

How Verdikx helps

Verdikx is a fraud, chargeback and dispute platform for e-commerce and SaaS merchants, made by Verdikx LLC. Verdikx never asks for or stores CVV codes. When a connected processor reports the CVV result (Stripe does), it goes into the dispute packet's payment record, and drafts describe it as the processor-reported result. On Growth and Pro, order screening flags card testing on Shopify orders, for example several different cards tried on one order or behind one buyer, shipping address or IP in 24 hours, and Pro risk rules can hold those orders automatically. Card blocklists use only the BIN, last 4 and expiry; Verdikx refuses a full card number.