iCVV stands for Integrated Circuit Card Verification Value.
To prevent fraud, it is a CVV code generated in a manner similar to the card's track data and printed onto the card's chip.
The term iCVV is used by Visa. The codes used by Visa, MasterCard, and American Express are listed below:
- iCVV – Visa
- Chip CVC – MasterCard
- iCSC - American Express
How is iCVV generated?
The iCVV generation algorithm is as follows:
iCVV = ENC(CVK[f(PAN & Exp Date & '999')] by Issuer
Why a separate CVV for the chip?
Chip cards also contain an equivalent of the magnetic stripe's Track 2 data inside the chip. If this data contained the same CVV as the magnetic stripe, a counterfeit magnetic card could be produced using the data read from the chip. iCVV ensures that a verification value different from the one on the magnetic stripe is used in the Track 2 equivalent data on the chip.
How does it work?
The issuing bank determines, via the F22 (POS Entry Mode) field, whether the Track 2 data received during the transaction was read from the chip or from the magnetic stripe. iCVV is verified for data read from the chip, while CVV1 is verified for data read from the magnetic stripe. If data read from the chip is sent as if it were magnetic stripe data, verification fails and the fraud attempt is detected.
The service code in the formula
As shown in the formula above, the value 999 is used in place of the service code when calculating iCVV. This method ensures that the CVV1, CVV2, and iCVV values differ from one another even when the same key and card data are used.
Dynamic cryptograms
In today's chip transactions, security relies largely not on iCVV but on cryptograms that are regenerated with every transaction. iCVV is an additional security layer that specifically prevents chip data from being misused in magnetic stripe transactions.
