Inside the Black Hole

What is Card Verification Value 2 (CVV2). All major credit card companies have placed card security codes on their credit and debit cards as an additional security feature for merchants who accept Visa cards as payment over the telephone or online. Visa’s Card Verification Value 2 (CVV2) is a three-digit number printed on the back of every Visa credit or debit card. It is located in the top right corner of the signature panel or immediately to the right of it. It is preceded by the last four digits of the card’s account number, printed in the signature panel. CVV2 was introduced to help e-commerce and mail order and telephone order (MO / TO) merchants verify that their customers are in a physical possession of their cards at the time of the transaction. It is a feature that all major e-commerce payment gateways support and your payment processing provider should make it available to you.

How to use CVV2. If your organization operates in either the e-commerce or the MO / TO industry, you should follow these procedures when accepting credit and debit cards:

1. Always ask your customers for the last three digits in the signature panel on the back of the card. Do not ask for the CVV2 number as customers will most likely have no idea what this is.
2. Depending on the response the customer gives to your CVV2 request, you should include one of the following indicators in your authorization request, along with the card’s expiration date and the account number:
   • “0″ – if the CVV2 is not included in the authorization request.
   • “1″ – if the CVV2 is included in the authorization request.
   • “2″ – if your customer has stated that the CVV2 is illegible.
   • “9″ – if your customer has stated that the CVV2 is not on the card.
3. When the card issuer replies with the CVV2 result code, you should take it into consideration, along with all other factors in determining the validity of the transaction. You will receive one of the following result codes:
   • “M” – Match – the CVV2 is valid.
   • “N” – No Match – the CVV2 is not valid, a very strong indicator of fraud. It may, however, be the result of a key-entry error, so you may consider resubmitting the CVV2 request.
   • “P” – CVV2 request not processed – you should resubmit the request.
   • “S” – the cardholder has stated that the CVV2 is not on the card. The CVV2 code should be printed on all Visa cards. In the case of an “S” response you should verify that the customer is looking for it in the right place.
   • “U” – the card issuer does not support CVV2. In this case you should considering other fraud prevention services.

Be advised that storing of CVV2 is prohibited. You may store other account information, e.g. cardholder name, account number and expiration date but not the CVV2.

Benefits of using CVV2. CVV2 benefits merchants operating in a card-not-present environment in a number of ways, including:

• Enhanced Fraud Protection. E-commerce and MO / TO merchants run a greater risk of processing transactions using stolen account numbers than their brick-and-mortar counterparts. Using CVV2 provides an additional step in the process of verifying the validity of both the card and the cardholder.
• Minimized Chargebacks. Reduced fraud leads to reduced fraud-related chargebacks. Chargebacks due to other reasons, however, will remain unaffected by the use of CVV2.
• Improved Bottom Line. Fraudulent and charged-back transactions lead to lost revenue and to additional processing costs. CVV2 helps limit such losses.

Learn how to minimize chargebacks and fraud

Learn how to minimize chargebacks and reduce your processing costs. The Chargeback Management kit contains a video and an e-book:

• E-Book – Chargeback Manual (40 pages).
• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).