PVV is the number encoded on a card's magnetic stripe that allows the cardholder's PIN to be verified by ATMs and POS terminals. It is a 4-digit cryptogram calculated through a cryptographic operation that uses the PIN and card data. The actual result is longer than 4 digits, but as part of the algorithm it is converted down to 4 digits.
The PVV value is present in the Track 1 and Track 2 data.
PVV is calculated as follows:
(PAN + PVKI + PIN) PVKey -> PVV
PVV = ENC(PVK[f(PAN, PIN)] by Issuer
- 11 digits of the card number are taken.
- A single-digit PVKI (PIN Verification Key Index) is used. (It usually contains the value "1".)
- The 4-digit PIN value is also added.
- The resulting 16-digit value is treated as an 8-byte hex representation.
- It is encrypted using the Triple DES PIN Verification Key.
Limitations of PVV
The PVV method does not store the PIN itself; it only stores a value used for verification. This prevents the PIN from being directly exposed in the event of a data breach.
However, since PVV is only four digits, even though it is difficult to compute without knowing the secret key, protecting the cryptographic keys is essential. These operations are carried out inside an HSM.
In modern systems, PIN verification is generally performed by querying the HSM, and values like PVV are never kept exposed on the application server.
