What it means
When you pay online, the website asks for your card number, expiry date and a short code. The code is not stored in the magnetic stripe or chip data that a thief might copy, so it helps show that the payer holds the card itself.
If the code does not match, the bank can decline the payment. On most cards the code is three digits on the back near the signature panel.
On American Express cards it is a four-digit code printed on the front. Different card networks use different names for it, such as CVV, CVC or CID, but the purpose is the same.
Validation codes also appear in other places. A bank may send a one-time code by text message or an app to confirm that you are the person trying to log in or approve a payment.
Tax and filing systems may ask for a code to confirm identity or to validate a submission, and software licences use codes to prove that a purchase is genuine. For merchants, using the code lowers the chance of fraud and often lowers processing costs.
A transaction that passes the check is less likely to be disputed later as unauthorised. Rules for card payments say that merchants must never store the code after a payment has been authorised, even in encrypted form.
That rule exists because stored codes would be a valuable target for criminals. A business that keeps them risks fines from card networks and the cost of a data breach.
Finance and payment teams should make sure that their systems, receipts and staff notes do not capture the code. A validation code is not perfect protection.
It does not prove who the cardholder is if the card has been stolen, and it can be stolen along with the number through phishing or a hacked site. It works best alongside other checks, such as address matching and extra authentication for large or unusual payments.
In practice
Real-world examples.
Example
An online shop asks customers for the three-digit code on the back of their card at checkout. Orders that fail the check are held for review, which cuts the number of fraudulent orders that ship. The shop also tracks how many genuine customers fail the check by mistyping, so it can keep the process friendly.
Example
A bank sends a six-digit code to a customer's phone when she tries to add a new payee. She enters the code to confirm that she, and not someone with her password, is making the request. The bank also limits each code to a few minutes of validity, so a stolen code is of little use to a fraudster.
Example
A telephone sales team writes down card details on paper, including the security code, for later entry. The compliance manager stops this practice because stored codes breach payment card rules and put the company at risk. He also arranges training for the team, so that every member understands why the code must never be written down.
Case study
Seen in the real world.
Tidewater Gifts is an illustrative, fictional online retailer that sells small items to customers around the world. After a spike in chargebacks, which are payments reversed by the card issuer after a customer disputes them, the finance manager reviews its checkout process.
She finds that the shop had switched off the requirement to enter the security code to make checkout faster. Chargebacks had risen from $4,000 to $19,000 a month since that change.
In this illustrative story she switches the check back on and adds one-time codes for large orders. Chargebacks fall to $6,000 a month, and she documents that the system never stores the code after authorisation. She also presents the monthly chargeback figures to the board, so the link between the check and the cost is clear to everyone.
Watch out
Common mistakes.
- Storing the code for convenience, when card rules forbid keeping it after a payment has been authorised.
- Believing the code proves the buyer is the real cardholder, when a thief with the physical card or a stolen set of details can also supply it.
- Switching off the check to reduce abandoned baskets, without measuring the extra fraud and chargeback cost.
Questions
People also ask.
Where is the code on a card?
On most cards it is three digits on the back, while on American Express cards it is four digits on the front.
Is a validation code the same as a PIN?
No, a PIN is a secret number used to authorise payments in person, while the validation code is printed on the card and used mainly for online and phone payments.
Why can merchants not store it?
Because stored codes are an attractive target for thieves and card network rules prohibit keeping them after authorisation.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related