What's the difference between CVV, CVC, and CID?

They're the same thing with different brand names. Visa calls it CVV (Card Verification Value), Mastercard calls it CVC (Card Verification Code), and American Express calls it CID (Card Identification Number). American Express also puts it on the front of the card in four digits instead of three on the back.

Can someone guess a CVV by trying all 1,000 possibilities?

Not in practice. Payment processors rate-limit authorization attempts aggressively. More than a few failed attempts on the same card number triggers a block. Brute-forcing a 3-digit CVV would require hundreds of attempts per card — that's detectable and shut down quickly.

Is it legal for merchants to store CVV2?

No. PCI DSS explicitly prohibits storing CVV2, CVC2, or CID after authorization. This applies to all merchants who process card payments. Violations can result in fines, losing the ability to accept cards, and significant liability in the event of a breach.

Why does CVV verification still let some fraud through?

CVV verifies that someone knows the digits printed on the physical card. It doesn't verify that the card is currently active, that the cardholder authorized the transaction, or that the card has available funds. Friendly fraud (a cardholder disputing a legitimate charge) passes CVV checks perfectly because the actual cardholder made the purchase.

What Is CVV? The 3 Digits Standing Between Merchants and $33 Billion in Fraud

Three numbers. They live on the back of your card — four if you have an Amex, and they live on the front, because Amex has always done things differently. You type them every time you shop online without thinking much about it. But those three digits are genuinely load-bearing, and merchants who understand them tend to lose considerably less money to fraud than the ones who treat them as just another form field.

Where CVV came from

It's 1994. Online shopping barely exists. But card-not-present fraud — fraud over the phone and through mail orders — is already a serious problem. A British payment standards body called APACS developed the concept of a short verification value that would be printed on the card but not encoded in the magnetic stripe. Visa adopted it commercially as CVV (Card Verification Value) in 1997. Mastercard followed with CVC (Card Verification Code). American Express called theirs CID — and put it on the front in four digits, because they were never going to do the same thing as everyone else.

The core insight was deceptively simple: if a fraudster skims your magnetic stripe, they can clone it. But they can't reproduce a number that isn't encoded there to begin with.

CVV1, CVV2, and the ones nobody talks about

Most people don't know there are actually multiple CVV values associated with a single card, generated separately for different transaction types:

CVV1 — encoded in the magnetic stripe, used for in-person swipe transactions. When a skimmer captures your stripe at a compromised gas pump, it gets CVV1. CVV1 is useless for online fraud because merchants aren't supposed to accept it for card-not-present transactions.
CVV2 — the three or four digits printed on the card. This is what you type online. Crucially, CVV2 is mathematically different from CVV1 — generated from the same inputs but with a different service code parameter. A skimmer copying the stripe doesn't automatically know CVV2.
iCVV — used for EMV chip transactions. Changes with each transaction, which makes it worthless to replay even if intercepted.
CVV3 / dCVV — used for contactless tap payments. Also dynamic in modern implementations.

How it's actually generated

This part is genuinely clever. Your CVV2 isn't a random number — it's deterministically computed from three inputs:

Your 16-digit card number (the PAN)
Your card expiry date
A secret key held by your issuing bank

The algorithm runs these through a 3DES encryption process and extracts three decimal digits from the result. There's no database of "card → CVV" pairs anywhere. When you type your CVV online, the bank recalculates the expected value on the fly using the same formula and checks whether it matches. If someone doesn't have the bank's secret key, they cannot derive a valid CVV from the card number alone. The only practical ways to know a valid CVV2 are: holding the physical card, photographing both sides, or buying it from someone who has done one of those things.

What a CVV check actually confirms

When a transaction goes through with a matching CVV2, the issuer has confirmed exactly one thing: the person submitting this transaction knows the three digits printed on the physical card.

That's more useful than it sounds. The majority of card data sold on underground markets comes from breaches of merchant databases — and PCI DSS explicitly prohibits storing CVV2. A fraudster who bought 5 million card numbers in a breach dump typically has the card number, expiry, name, and billing address, but not the CVV2. CVV checking blocks that entire category of attack.

~55%of merchants use CVV checks as part of their fraud prevention

$28Bin projected card-not-present fraud losses in 2026

What CVV doesn't confirm (read this part carefully)

CVV matching is necessary but not sufficient. Here's what it doesn't tell you:

Whether the card is currently active. A card with the correct CVV2 can still be expired, suspended, over-limit, flagged for fraud, or closed. CVV matching doesn't query the card's current status — it just validates the number.
Whether the cardholder authorized this transaction. Friendly fraud — where a cardholder uses their own card and then disputes the charge — passes CVV checks perfectly. Friendly fraud accounts for roughly 79% of all disputed transactions according to industry data.
Whether the card has available funds. A positive CVV result says nothing about balance.

Why $33.79 billion in chargebacks still happened in 2025

Despite widespread CVV adoption, chargeback losses hit $33.79 billion in 2025 across an estimated 261 million disputed transactions. CVV checking reduces one category of fraud. It doesn't cover friendly fraud, account takeover, or cases where the fraudster has the physical card (or a photo of it).

For merchants who need to know whether a card is genuinely active — not just that someone knows its CVV — the answer is a live authorization check: a zero-dollar inquiry or small auth hold sent directly to the card network. This tells you in real time whether the card will authorize before you attempt an actual charge.