CVV is short for Card Verification Value. It is a term used by Visa.
CVC is short for Card Verification Code. It is a term used by MasterCard.
The CVV/CVC code is a 3-digit numeric value used for cardholder verification and to reduce fraud risk. It is generated during card production and printed onto the card's magnetic data (Track 1 and Track 2).
The CVV value is generated using an algorithm. It is used in authorization for physical card transactions. Three pieces of information and a key pair are required to determine the CVV value:
- Card Number (PAN)
- 4-digit Expiration Date
- 3-digit Service Code
- CVK Keys (CVK A/CVK B) (Card Verification Key Pairs) (2 DES key pairs)
It should not be confused with the 3-digit security code (CVV2) printed on the back of the card. The CVV2 code on the back of the card is not used for physical card transactions; it is used for card-not-present transactions.
Information used in the CVV calculation
The CVV is calculated using the card number, expiration date, and service code together with a secret key. Without knowing this key, no outside party can produce the same value.
For this reason, anyone wanting to produce a counterfeit card must guess a valid CVV. The issuer verifies the CVV read from the card's magnetic stripe by recalculating it with the key.
Protecting the keys is the foundation of the security of this verification system.
