CVV (CVC) and CVV2 (CVC2) are two terms that cardholders often confuse. Both are used for verification in card transactions, but there are some notable differences between them:
| CVV | CVV2 |
| Printed on the card's magnetic stripe. | Printed on the back of the card. |
| It is 3 digits. | It is 3 digits. (4 digits on Amex cards.) |
| Used for verification in physical POS transactions. | Used for verification in MOTO or e-commerce transactions. |
| Regenerated when the card is renewed. | Regenerated when the card is renewed. |
| Verified in Card Present transactions. | Valid for Card Not Present transactions. |
| Encoded in the card's Track 1 and Track 2 data. | Not encoded in the card's Track 1 and Track 2 data. |
| Must always be verified in physical transactions. | In recurring transactions (for example, monthly insurance payments), the transaction can be approved without verifying CVV2. |
| Generated with a different algorithm than CVV2. | Generated with a different algorithm than CVV. |
Why are there two separate values?
Because CVV sits on the magnetic stripe, it protects against physical cloning of the card. CVV2, on the other hand, is printed only on the card itself and serves to show, in online transactions, that the cardholder actually has the card in hand.
Even if a fraudster copies the magnetic stripe, they cannot make an online purchase without knowing the CVV2; conversely, someone who knows the CVV2 cannot clone a physical card with it.
This is why generating the two values differently is fundamental to security. The iCVV on chip cards likewise carries a separate value within the chip data for a similar purpose.