What is a CVC in payments?
A CVC, or Card Verification Code, is a short security code printed on a payment card and used to help verify that the person making a purchase has the card in their possession. It is most commonly requested during online, mail order, or telephone transactions where the merchant cannot inspect the physical card.
Where is the CVC found on a card?
For most Visa and Mastercard cards, the CVC is a three digit number printed on the back of the card, usually near the signature strip. On American Express cards, the equivalent code is typically four digits and appears on the front. Different card brands use slightly different labels, such as CVV or CID, but the purpose is broadly the same.
Why is the CVC important?
The CVC adds an extra security check for card not present payments. A fraudster might obtain a card number and expiry date through a data leak or phishing attack, but without the CVC they are less likely to complete a transaction successfully. It does not stop all fraud, though it helps reduce unauthorised use.
Can merchants store the CVC?
No. Under PCI DSS rules, merchants and payment providers must not store the CVC after authorisation. This rule exists because the code is considered sensitive authentication data. Removing it from storage reduces the impact of a data breach and makes stolen databases less useful to criminals.
Is CVC the same as a PIN?
No. A CVC is a printed security code used mainly for remote transactions, while a PIN is a secret number entered by the cardholder, usually during in person transactions at payment terminals or cash machines. They serve different purposes and are used in different parts of the payments process.