What is a card verification code?¶

A card verification code is a short security value used to help confirm that the person making a card-not-present payment has access to the card details.

Avoid this assumption: Correct use of the code proves the cardholder made the payment.

The code may appear on the physical card or be generated dynamically, depending on the card and provider.

Merchants may request it during online or telephone payments as an additional check alongside the card number and expiry date.

A successful code check shows that the correct value was supplied. It does not show who supplied it, how they obtained it or whether the cardholder consented.

The code may have been copied from the card, disclosed during phishing, stored insecurely, viewed by another person or entered by someone with legitimate access.

Some merchants or recurring-payment arrangements may not request the code for every transaction.

Relevant records may include whether the code was requested, whether the check succeeded, the merchant, transaction reference, timestamp, device or browser data and any linked authentication event.

Ask the issuer or processor what result was recorded and whether the transaction was treated as card-not-present, recurring, tokenised or merchant-initiated.

Do not treat absence of the code as proof that the payment was unauthorised. The payment route may not have required it.

Likewise, do not treat successful use as proof of identity.

Compare the record with device evidence, merchant account activity, communications, delivery information and card possession.

When reporting, state that the verification code check succeeded or failed rather than asserting who entered it.

Operational takeaway¶

Use card verification code results to show whether the security value was supplied, then rely on separate evidence to identify the person and circumstances behind the payment.