Validation Code: What It Is and How It Works

What is a validation code?

A validation code (often called CVV, CVV2, CVC, or CV2) is a three- or four-digit number printed on a payment card that provides an extra layer of security for card-not-present transactions (online or phone purchases). Most cards show the code on the back, on or near the signature panel; American Express cards display a four-digit code on the front.

Key takeaways

• The validation code helps verify that the buyer has physical possession of the card during a card-not-present transaction.
• It is typically three digits (Visa, Mastercard, Discover) or four digits (American Express).
• Card networks and payment regulations prohibit merchants from storing validation codes after a transaction.
• Validation codes reduce fraud risk but do not eliminate it; consumers should protect this number like the card number and expiration date.

How validation codes are used

1. During checkout for an online or phone purchase, merchants commonly ask for:
2. Card number
3. Expiration date
4. Billing name and address
5. Validation code (CVV/CVC)
6. The merchant transmits the card details and the validation code to the card issuer or payment processor. The issuer verifies that the code matches the card number on file and either approves or declines the transaction.
7. Because validation codes are not embossed on receipts and cannot be stored by merchants, they make it harder for fraudsters to complete unauthorized card-not-present transactions using only a card number.

Security limits and protections

• Validation codes help deter casual fraud but are not foolproof; determined criminals can still obtain full card details through data breaches, skimming, social engineering, or stolen cards.
• Card networks, payment processors, and industry standards (e.g., PCI rules) prohibit merchants from retaining CVV/CVC data after authorization.
• Point-of-sale transactions typically require a PIN or chip authentication, which provides additional protection for in-person purchases.

Real-world context and what to do if your card is compromised

• Credit card fraud has continued to rise in recent years, with industry reports estimating billions in global losses and many hundreds of thousands of reported incidents annually.
• If your card is lost, stolen, or you see unauthorized transactions:
• Contact your card issuer immediately to report the issue and request card cancellation.
• Review your statements and dispute unfamiliar charges with the issuer.
• Under U.S. consumer protections, cardholder liability for unauthorized charges is limited (for example, federal protections historically limited liability to a small amount if reported promptly), but exact limits and conditions depend on timing and your card agreement.
• Treat the validation code with the same care as your card number and expiration date: do not share it in unsolicited messages and guard photos of your card.

Conclusion

Validation codes are a simple but important security measure for card-not-present transactions. They reduce fraud risk by confirming card possession at the time of purchase, but consumers should combine awareness of CVV protection with other practices—monitoring accounts, reporting suspicious activity, and using secure payment methods—to minimize fraud exposure.