CVV Length Verification: How 3- and 4-Digit Codes Get Checked
CVV is 3 digits on Visa, Mastercard, and Discover, and 4 on American Express. Verification is a match check at the issuer, not a format or math test.
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A CVV is 3 digits on most payment cards. American Express cards use 4 digits. The code is printed on the card and is not part of the account number. Each network sets its own length, so verification rules depend on the brand on the front of the card.
Two cards from one bank can carry different lengths if the bank issues both Visa and American Express products.
Visa, Mastercard, Discover, JCB, UnionPay and Elo print the code on the back, inside or next to the signature panel. It follows the last 4 digits of the account number. American Express prints a 4-digit code on the front, above and to the right of the account number. Some Amex cards show a 3-digit number on the back. That value is not the CID.
The issuer generates the code from the account number, the expiration date and a secret key. A merchant sends the code in the authorization request. The issuer recomputes the value and compares. The response carries a result code.
An I response means the length or the characters were rejected before the issuer saw the request.
A payment form should accept 3 digits for the 3-digit networks and 4 digits for American Express. It should accept digits and nothing else. Leading zeros are valid and must not be trimmed. The field should be masked in the page and in logs. Length checks are not verification. A well-formed code can fail the issuer check.
PCI DSS Requirement 3.2 classifies the CVV as sensitive authentication data. It must not be stored after authorization, even in encrypted form. That covers CVV2, CVC2, CID, CAV2 and CVN2, plus full track data and PIN blocks. A merchant that keeps the code fails a PCI assessment.
Federal law, 18 U.S.C. 1029, covers fraud and misuse of payment card data. Do not enter card data you are not authorized to use.