CVV Length Verification: How 3- and 4-Digit Codes Get Checked
CVV is 3 digits on Visa, Mastercard, and Discover, and 4 on American Express. Verification is a match check at the issuer, not a format or math test.
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A CVV length verification tool checks the number of digits a shopper enters in the card security code field. Visa, Mastercard, and Discover cards use a 3-digit code, while American Express uses a 4-digit code, so the tool confirms the input matches the expected format for that card brand before the payment request is sent. Length verification is a format check only. It does not prove the code is genuine or that the card belongs to the person typing it.
The right length depends on the card network, not on the issuing bank or the country where the card was issued. A validation rule keyed to the card brand handles the difference correctly.
Some regional networks, including UnionPay, also print 3 digits. A small number of card products carry no security code at all, so a form should not hard-block a payment when the brand cannot be identified.
Any four random digits satisfy an American Express length rule, and any three satisfy a Visa rule. Only the issuer can confirm that a security code matches the account. Treat the length check as one part of input hygiene, alongside card number validation, expiration date checks, and address verification. It reduces mistyped orders and failed authorizations, and it should never be described to customers as a security guarantee.
PCI DSS classifies the card security code as sensitive authentication data. Merchants and their processors may not store it after authorization, and it should not appear in logs, error reports, or analytics events. Build the verification tool so the value exists only for the duration of the request. Masking the field and disabling autocomplete on the input also keeps the code out of browser caches.
No. The digit count follows the card network, so a Visa issued anywhere still carries 3 digits.
No. A PIN authorizes transactions at an ATM or terminal, while the CVV supports card-not-present payments such as online orders.
Most processors allow a transaction without it, but approval rates usually drop. Keep the field required when the brand is known and allow an empty value when it is not.