CVV2

Introduction

CVV2 is an important three or four-digit security feature for accepting credit cards as payment over the telephone or online. This value is printed on the card or signature strip but not encoded on the magnetic stripe. The major card schemes have different names for the three-digit Card Security Code:

• MasterCard - CVC2 (Card Validation Code)
• VISA - CVV2 (Card Verification Value)
• JCB - CAV2 (Card Authentication Value)
• American Express - CID or 4DBC (Card Identification Data or 4-Digit Banking Code)

Located on the back of all credit cards, the CVV2 code consists of the last three digits either printed on the signature panel or on a white box to the right of the security panel.
American Express cards have a four-digit code printed on the front side of the card above the number, referred to as the CID or 4DBC.

Overview

In the card-not-present sales environment, CVV2 is an excellent tool for verifying that the customer has a legitimate credit card in hand at the time of the sales order.

1. The customer contacts the merchant to place an order.
2. On your payment page you ask the customer for the CVV2 code and send it to the card issuer as part of the authorization request.
3. The card issuer checks the CVV2 code to determine its validity, and then sends a CVV2 result code back to the merchant along with the authorization decision.
4. Before completing the transaction, the merchant evaluates the CVV2 result code, taking into account the authorization decision and any other relevant or questionable data. A merchant may also verify CVV2 without an accompanying authorization request by using the $0 Account Verification Message, which is available in some regions.

Because card-not-present transactions are at greater risk for stolen account number schemes, you need to be diligent in your fraud control efforts. CVV2 can help you differentiate between good customers and fraudsters who operate anonymously. It allows you to make a more informed decision before completing a non-face-to-face transaction.

• Reduced Chargebacks: Using CVV2 potentially reduces fraud-related chargeback volume. Reduced fraud-related chargebacks translate into maximized profitability.
• Improved Bottom Line: For card-not-present merchants, fraudulent transactions can lead to lost revenue and can also mean extra processing time and costs, which often narrow profit margins. CVV2 complements the merchant‘s current fraud detection tools to provide a greater opportunity to control losses and operating costs.

Status Codes

After obtaining the card CVV2 Result Code, Account Number, and Card Expiration Date:

1. Send the CVV2 presence indicators as requested in the programmers guide along with other required authorization data (i.e. account number, expiration date and transaction amount).
2. After receiving a positive authorization response, evaluate the CVV2 result code and take appropriate action based on all transaction characteristics.

Additional Information

The use of the Card Verification Value is one of the basic fraud control actions. If the CVV2 service is available, obtain the CVV2 three or four-digit code from the cardholder. An issuer-validated CVV2 code is a good indicator that the card is genuine.