Nature and Purpose of CVV2 / CSC / CVC as Used in Credit Card Processing

The card security code (CSC), sometimes called Card Verification Data (CVD), Card Verification Value (CVV or CVV2), Card Verification Value Code (CVVC), Card Verification Code (CVC or CVC2), Verification Code (V-Code or V Code), or Card Code Verification (CCV) are different terms for security features for credit or debit card transactions, providing increased protection against credit card fraud.

The CVV2 is a three- or four-digit value printed on the card or signature strip, but not encoded on the magnetic stripe.

MasterCard, Visa, Diners Club, Discover, and JCB credit and debit cards have a three-digit card security code, called the following:

 

"CVC2" (card validation code) MasterCard,

"CVV2" (card verification value) Visa,

"CID2" (card identification) number, Discover.

 

It is not embossed like the card number, and is always the final group of numbers printed on the back signature panel of the card. New North American MasterCard and Visa cards feature the "CVC2" in a separate panel to the right of the signature strip. This has been done to prevent overwriting of the numbers by signing the card.

 

American Express cards have a four-digit code printed on the front side of the card above the number, referred to as the CID (or Unique Card Code). It is printed flat, not embossed like the card number.

 

Supplying the CVV2 in a transaction is intended to verify that the customer has the card in their possession. Knowledge of the code proves that the customer has seen the card, or has seen a record made by somebody who saw the card. This provides a level of protection to the bank/cardholder, in that a corrupt merchant cannot simply capture the magnetic stripe details of a card and use them later for "card not present" purchases over the phone, mail order or Internet. To do this, a merchant would also have to note the CVV2 visually and record it, which is more likely to arouse the cardholder's suspicion.

 

 

Merchants who require the CVV2 for "card not present" transactions are forbidden in the USA by Visa from storing the CVV2 once the individual transaction is authorized and completed. This way, if a database of transactions is compromised, the CVV2 is not included, and the stolen card numbers are less useful.

 

Source: http://en.wikipedia.org/wiki/Card_security_code