CVV is a very critical 3-digit value used during a card's authorization process. The CVV value is encoded in the card's magnetic stripe data. (Track 1 and Track 2 data)
Is the CVV value generated according to an algorithm, or is it determined as a random value?
Determining the CVV value requires 3 pieces of information and a key pair:
- Card Number (PAN)
- 4-digit Expiration Date
- 3-digit Service Code
- CVK Keys (CVK A/CVK B) (Card Verification Key Pairs) (2 DES key pairs)
CVV = ENC(CVK[f(PAN || Exp Date || Svc Code)] by Issuer
Why is the service code different?
The service code used in the formula changes depending on which verification value is being generated. For CVV1 on the magnetic stripe, the card's actual service code is used. For CVV2 on the back of the card, the value 000 is used instead of the service code, and for iCVV on the chip, the value 999 is used. This way, three different verification values are generated for the same card.
Why three different values?
Using different values prevents information captured on one channel from being used on another. For example, if the magnetic stripe is copied, CVV1 is exposed, but this value is useless for online purchases because it is not the same as the CVV2 that is requested. Likewise, a CVV2 captured online cannot be used to produce a counterfeit magnetic stripe card.
Does the CVV change when the card is renewed?
Since the expiration date is also used in the CVV calculation, the CVV values change whenever the expiration date changes upon card renewal. For this reason, cardholders whose cards have been renewed may need to update their card information on the shopping sites where it is saved.
Dynamic CVV
On some cards, the security code on the back is not fixed. A security code that changes at regular intervals is shown on a small screen on the card or in a mobile app. This method ensures that even if the card information is captured, the code becomes invalid shortly afterward.
