Talk:Card security code

message: Q. Is the CVV2 number related to the actual credit card number? Is it a random number? Or is there some other way that the card issuer  selects the CVV2 number to put on a card?
—Preceding unsigned comment added by 207.233.79.134 (talk • contribs)  23:27, 4 August 2005
A. I don't think MC or Visa require a particular algorithm, so it can be a random number stored in a secure lookup table, or it can be a derived number based on card data using a secret issuer key.
—Preceding unsigned comment added by 38.112.4.254 (talk • contribs)  21:02, 31 March 2006 
:: The CVV2 is an encryption of the card number and expiry date, under a key known only to the issuing bank.  The CVV on the magstripe is similar but the encryption also covers the service code, a value on the magnetic stripe. Zaian 10:46, 18 June 2006 (UTC)
replies: text:  This isn't an encryption, although it may be a hash. The bank can't recover the card number, no matter how many keys they have, from a mere 3 digits! Andy Dingley (talk) 16:52, 10 June 2008 (UTC)
thread_title: Related to actual number?

message: Q. I would request to provide details on how does CVV verification process work. for example when a user enters his CVV in the payment termina intertface then what verification and validation processes occur in backgroung and the user gets authorized for the transaction. such information would be most appreciated.
Lavkru (talk) 09:48, 7 May 2013 (UTC)
replies: text: I agree. When I call up my telco to pay my bill, and they ask me "and now sir, can I have the last three digits from the back of the card", how do I know they won't use it in conjunction with the credit card number I just provided them to buy lots of stuff? I suppose it might help for things like dumpster-diving receipts etc, where the CVC is not printed... but I think it's less useful than people give it credit for (no pun intended :-) StephenFalken 00:05, 2 May 2006 (UTC)
replies: text:   See, that is why I just use bill pay services from my bank, no need to talk to a person by phone and provide them with that number, I personally try to avoid giving out my credit card to a company except for a secure website, and I would prefer the companies to not store my credit card as a permanent record and just use it for that one transaction  Quazywabbit 06:28, 20 May 2006 (UTC)
thread_title:  Security model 

message: The value of this system of security may be disputed. Anybody who can look at the card or recive payment orders with this validation code can know its value. For this reason it can not be anymore consider that the only person who know the code is the legittate owner of the card after the card is used the first time (or even before that, if anybody can look at the card). Morover the value is also known by the credit card society. AnyFile 14:21, 19 August 2005 (UTC)
replies: text: On your last point, the value is not known (i.e. is not stored) by the issuing bank.  The value is obtained by encrypting some card details.  The validation process is that the transaction details are sent to a secure cryptographic device called a Hardware Security Module (HSM) which internally derives the CVV2 for the card and returns a "Yes/No" response indicating whether the CVV2 supplied was correct or not. It's a "black box" - the software can ask the HSM "was this CVV2 right?" but not "what is the CVV2 for this card?".  This is similar to the process for validating PINs. Zaian 10:46, 18 June 2006 (UTC)
thread_title:  Is it really sure? 

message: There are some cases where a possible attacker has access to the credit card number, but not the CVV2. For instance, an employee at a store that takes credit cards may be able to make copies of large numbers of receipts, and the credit card number. In this case a person could make a large number of relatively small purchases on-line in a short period of time. Without the physical credit card or the CVV2, it is difficult to do this.
Of course, an employee would be able to record the CVV2 for any card that they physically handled, but in this case sales records would be able to identify the employee.
This is a guess, but it seems reasonable.
—Preceding unsigned comment added by 82.93.59.73 (talk • contribs)  18:18, 21 August 2005
:Well, it is not so dificcult for an employer of a shop (or for the owner of the shop too) to look at the secutity code without being seen as suspicious. On some cards the security code is on the front and in other cases is next to the signaure box on the back of the card (which the merchant has contract right and duty to check at). The code is enought small to be memorized, so there no need to write it down immidiately rising suspicious. Morover in many case I see the teller write down on the credit card recipes many informations (the number of the day selling, and so on). The security code could be written among the same datas without rising souspicious, or it can even be written in a encripten form. if the fraud is made some time later (even months since the card is usually valid for 2 years and all the information needed, including the security code, do not change in the meantime) it would very difficult to track down all the place it was used in the time. And unless the teller is so silly to buy things online and have them sent to his/her postal address, it is very difficult to link among the use of the credit card and a specific sale, when the card was use.
:I have to say that my opinion is that this, so called, security code only add a very little protection, and this addictional small protection is completely void when you reveal the CCV2 data. It is difficult to have a really safe system when the card is used at distance. All the datas sent can be read by at leat someone and if the exactly same datas is all is needed to make another transaction, the protection is rather low. In my opinion the only way to solve this issue is that among the datas trasmited should be only know by the owner and that this data change at any time of use (and optionally depends also on the name or on the code of the merchant). AnyFile 13:45, 9 July 2006 (UTC)
thread_title:  Imprints 

message: I'm not sure how to phrase this in the article, but since the CVV2 can be stored prior to the completion of a transaction, in the case of a time-delayed transaction this storage period may in fact be very lengthy. I am currently working with a client that requires up to six months between collection and charging, and for technical reasons verification of the card is not possible at time of collection. I realize this sounds stupid, but it is allowed (though discouraged) in the specs. I'm not sure if this should be listed as a "drawback," since it seems to be a problem with a particular system's business requirements rather than the number itself. But that could be arguable about most of the drawbacks, so I'm not sure.
12.205.149.45 22:54, 3 August 2007 (UTC)
thread_title:  Retention is possible 

message: There is an incorrect statement in this article: 
"The CVV2 is a 3- or 4-digit value printed on the card or signature strip, but not encoded on the magnetic stripe."
In this article, it is stated that the magnetic strip may include CVV:
http://en.wikipedia.org/wiki/Magnetic_stripe
Financial cards
Discretionary data — may include Pin Verification Key Indicator (PVKI, 1 character), Pin Verification Value (PVV, 4 characters), Card Verification Value or Card Verification Code (CVV or CVK, 3 characters) 
Jimmied999 14:19, 14 August 2007 (UTC)
replies: text: CVV1 is stored on the card. CVV2 is not. I think the statement is accurate Talyian 16:07, 14 September 2007 (UTC)

text: Talyian is correct - CVV1 is on the mag stripe, CVV2 is printed on the card and is not present on the mag stripe. Dkam (talk) 12:39, 12 July 2009 (UTC)
thread_title:  Location of CVV2 

message: When did this whole CSC thing get started?  I think it would be nice to have a "History" section in this article.  I know that 10 or 20 years ago, cards didn't have this.  Westwind273 17:30, 17 September 2007 (UTC)
thread_title:  History 

message: It seems like the article should say...  —Preceding unsigned comment added by 206.168.188.130 (talk) 19:02, 26 October 2007 (UTC)
thread_title:  What do the acronyms stand for? 

message: I could not find a Spanish version Wikipedia page for Card Security Code. Can someone please post it here?  —Preceding unsigned comment added by 209.251.128.198 (talk) 21:50, 9 September 2009 (UTC)
thread_title:  What is the Spanish page for this entry? 

message: Reference 3 to visa rules appears to go to a chargeback information page instead of the rules.  Sorry I do not have the time to go searching for it today...Skaterdad (talk) 00:58, 28 March 2011 (UTC)
thread_title:  Reference (3) link is bad 

message: http://www.zeit.de/2011/21/Kreditkarten-Sicherheit (german)  —Preceding unsigned comment added by 84.157.21.179 (talk) 10:12, 21 May 2011 (UTC)
thread_title:  CVV2 hacked! 

message: The article is correct that security codes are often used for mail transactions, but recording the code on paper is prohibited by all of the credit card companies. Does this deserve its own section in the article?  If nothing else, a clarification should be made using the AmEx language: they're for real-time card-not-present transactions.
This is definitely controversial, as it's an area where common practice stands in opposition to official policy, so I'd like to see some discussion before making any changes.
; Visa
Avoid CVV2 Storage. All merchants are prohibited from storing CVV2 data. When asking a cardholder for CVV2, merchants must not document this information on any kind of paper order form or store it on any database.  [Rules for Visa Merchants, 2007, page 12]
; MasterCard
Merchants ... must not store card validation code 2 (CVC 2) data in any manner for any purpose. ... At its discretion, MasterCard may impose a noncompliance assessment of up to USD 100,000 per each individual violation of this Standard, with a maximum aggregate assessment of USD 500,000 for additional or continuing violations during any consecutive 12-month period. [Security Rules and Procedures-Merchant Edition, Section 10.2, July 2009]
; American Express
CID numbers must not be stored for any purpose. They are available for real time Transactions only. [American Express Merchant Reference Guide – U.S., section 5.10, 2009] — Preceding unsigned comment added by Coloradoauthor (talk • contribs) 22:21, 16 May 2012 (UTC)
replies: text: Its own section, no. A sentence or two summarizing (and sourced to) the above, sure. Anomie⚔ 01:11, 17 May 2012 (UTC)
thread_title:  Prohibition on recording codes on paper forms 

message: Have noticed that there is a 3 digit code at the right hand end of the signature panel on my American Express cards (those from AXP itself and those from two other independent issuers).  I would imagine that this is for the benefit of procedures or hardware that only allow for a 3 digit CVV.  knoodelhed (talk) 17:38, 15 October 2013 (UTC)
thread_title:  3 digit CVV on AXP signature panel 

message: Hello fellow Wikipedians,
I have just modified  on Card security code. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20140424011239/https://www.securesuite.net/cibc/tdsecure/spc_description.jsp?cycfg_affinity=mc to https://www.securesuite.net/cibc/tdsecure/spc_description.jsp?cycfg_affinity=mc
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—InternetArchiveBot (Report bug) 01:32, 15 November 2016 (UTC)
thread_title:  External links modified 

message: Why is this article primarily talking about magnetic stripes? Surely that is decades-out-of-date tech, replaced by smartcard chips ages ago? Is this article out of date, or are there still some countries (3rd world maybe?) that still use mag stripes? Can this article be updated to primarily refer to chips please? Andrew Oakley (talk) 09:50, 30 July 2020 (UTC)
replies: text: I may tell a secret to you, but mag stripe is still must to be accepted everywhere. Lol. Unless it is next gen where there is no mag stripe and "Signature is not required" is written. Or if you cannot sign your transaction sheet. 2A00:1FA0:4638:232D:D94:FC02:20D6:E94B (talk) 08:24, 23 August 2020 (UTC)
replies: text: Or if the terminal does not support that. And that is most of modern ones, also if there is no human for example like in automatic kiosks... Both card (as you mentioned) and terminal can say they do not support this method, called signature in cardholder verification process. 109.252.90.66 (talk) 18:30, 25 March 2021 (UTC)
thread_title:  Magnetic stripe? 

message: Why does the CVV number also compile the number text of 3 or 4, why is it that way 105.112.176.194 (talk) 15:49, 11 August 2022 (UTC)
thread_title:  About CVV 

message: I’m new to this who do I ask for help 2601:152:302:59A6:3057:B73E:6C08:5946 (talk) 17:14, 13 October 2022 (UTC)
thread_title:  Hey