A CVV is 3 digits on Visa, Mastercard, Discover and JCB cards. It is 4 digits on American Express. There is no test you can run on a CVV value. The code carries no check digit, no arithmetic link to the card number, and no offline validation path. A CVV passes or fails when an issuer answers a live authorization request, and at no other time.
What the printed code is
The printed code goes by different names per network. Visa calls it CVV2, Mastercard calls it CVC2, American Express calls it CID, and Discover calls it a Card Identification Number. All of them sit apart from the magnetic stripe and the chip.
- CVV1 is encoded in the magnetic stripe track data. It is not printed.
- iCVV is generated by the chip for chip transactions.
- CVV2, CVC2 and CID are printed on the card body for card-not-present orders.
Digit counts by network
- Visa: 3 digits, back of card, in or next to the signature panel.
- Mastercard: 3 digits, back of card, in the signature panel.
- Discover: 3 digits, back of card, in the signature panel.
- JCB: 3 digits, back of card.
- American Express: 4 digits, front of card, above the right edge of the card number.
Why no valid test exists
The code is issued by the bank and stored on the bank side. It is not computed from the primary account number, so a Luhn check tells you nothing about it. Two cards from the same issuer can carry unrelated codes. A format check reads the shape of the string: three digits, or four digits for Amex. That check confirms the field holds digits of the right length. It does not confirm the card, the account, or the code.
Tools that advertise a CVV test or checker have nothing to compare against. They return a guess. A real check needs a merchant account, a payment gateway, and an authorization request that travels to the issuer.
What a real verification returns
The merchant sends the code in the payment data field of an authorization request. The issuer replies with a result code, such as match, no match, not processed, or issuer unable to process. The gateway logs that response. Card verification and address verification are separate results.
Common format mistakes
- Typing the 4-digit Amex CID into a 3-digit field. The form cuts the last digit.
- Using the card PIN instead of the printed code.
- Using the last three digits of the card number.
- Leaving a space or a leading zero that the form strips.
Legal limits
Submitting CVV values against live merchant pages without authorization is fraud, and card testing traffic is easy to spot in gateway logs. The cardholder, or a merchant acting on a real order, is the party that can send a code for verification.