A card security code, sometimes called card verification data, card verification number,
card verification value, card verification value code, card verification code, verification
code, card code verification, or signature panel code are different terms for a security
feature for "card not present" payment card transactions instituted to reduce the incidence
of credit card fraud. The CSC is in addition to the bank card number
which is embossed or printed on the card. The CSC is used as a security feature, in
situations where a PIN cannot be used. The PIN is not printed or embedded on the card
but is manually entered by the cardholder during a point-of-sale transactions. Contactless
card and chip cards may electronically generate their own code, such as iCVV or Dynamic CVV.
MasterCard started issuing CSCs in 1997 and Visa in the United States issued them by 2001.
American Express started to use the CSC in 1999 in response to growing internet transactions
and card member complaints of spending interruptions when the security of a card has been brought
into question.
Description The codes have different names:
MasterCard – card validation code Visa – card verification value
Discover – card identification number American Express – "CID" or "unique card
code" Debit Card – "CSC" or "card security code"
Types of codes There are several types of security codes:
The first code, called CVC1 or CVV1, is encoded on track-2 of the magnetic stripe of the card
and used for card present transactions. The purpose of the code is to verify that a payment
card is actually in the hand of the merchant. This code is automatically retrieved when
the magnetic stripe of a card is swiped on a point-of-sale device and is verified by
the issuer. A limitation is that if the entire card has been duplicated and the magnetic
stripe copied, then the code is still valid. The second code, and the most cited, is CVV2
or CVC2. This code is often sought by merchants for card not present transactions occurring
by mail or fax or over the telephone or Internet. In some countries in Western Europe, card
issuers require a merchant to obtain the code when the cardholder is not present in person.
Contactless card and chip cards may supply their own codes generated electronically,
such as iCVV or Dynamic CVV. Location of code
The card security code is typically the last three or four digits printed, not embossed
like the card number, on the signature strip on the back of the card. On American Express
cards, the card security code is the four digits printed on the front towards the right.
The card security code is not encoded on the magnetic stripe but is printed flat.
American Express cards have a four-digit code printed on the front side of the card above
the number. MasterCard, Visa, Diners Club, Discover, and
JCB credit and debit cards have a three-digit card security code. The code is the final
group of numbers printed on the back signature panel of the card.
New North American MasterCard and Visa cards feature the code in a separate panel to the
right of the signature strip. This has been done to prevent overwriting of the numbers
by signing the card. Security benefits
As a security measure, merchants who require the CVV2 for "card not present" payment card
transactions are required by the card issuer not to store the CVV2 once the individual
transaction is authorized and completed. This way, if a database of transactions is compromised,
the CVV2 is not included, and the stolen card numbers are less useful. Virtual terminals
and payment gateways do not store the CVV2 code, therefore employees and customer service
representatives with access to these web-based payment interfaces who otherwise have access
to complete card numbers, expiration dates, and other information still lack the CVV2
code. The Payment Card Industry Data Security Standard
also prohibits the storage of CSC post transaction authorisation. This applies globally to anyone
who stores, processes or transmits card holder data. Since the CSC is not contained on the
magnetic stripe of the card, it is not typically included in the transaction when the card
is used face to face at a merchant. However, some merchants in North America, such as Sears
and Staples, require the code. For American Express cards, this has been an invariable
practice in European Union states like Ireland and the United Kingdom since the start of
2005. This provides a level of protection to the bank/cardholder, in that a fraudulent
merchant or employee cannot simply capture the magnetic stripe details of a card and
use them later for "card not present" purchases over the phone, mail order or Internet. To
do this, a merchant or its employee would also have to note the CVV2 visually and record
it, which is more likely to arouse the cardholder's suspicion.
Supplying the CSC code in a transaction is intended to verify that the customer has the
card in their possession. Knowledge of the code proves that the customer has seen the
card, or has seen a record made by somebody who saw the card.
Limitations The use of the CSC cannot protect against
phishing scams, where the cardholder is tricked into entering the CSC among other card details
via a fraudulent website. The growth in phishing has reduced the real-world effectiveness of
the CSC as an anti-fraud device. There is now also a scam where a phisher has already
obtained the card account number and gives this information to the victims before asking
for the CSC. Since the CSC may not be stored by the merchant
for any length of time, a merchant who needs to regularly bill a card for a regular subscription
would not be able to provide the code after the initial transaction. Payment gateways,
however, have responded by adding "periodic bill" features as part of the authorization
process. Some card issuers do not use the CSC. However,
transactions without CSC are likely to be subjected to higher card processing cost to
the merchants, and fraudulent transactions without CSC are more likely to be resolved
in favour of the cardholder. It is not mandatory for a merchant to require
the security code for making a transaction, hence the card may still be prone to fraud
even if only its number is known to phishers. Generation of CSC
The CSC for each card is generated by the card issuer when the card is issued. It is
calculated by encrypting the bank card number, expiration date and service code with encryption
keys known only to the card issuer, and decimalising the result.
See also Credit card fraud
ISO 8583 References