Merchants are prohibited from storing CVV, CVV2, CVC2 & CID per PCI standards
Posted on Monday, October 08, 2007
A Card Verification Value code, CVV, (CVV2 for Visa, CVC2 for MasterCard and CID for AMEX) is the three or four digit number located either on the front or back of a credit or debit card. Merchant's can request the CVV code from card holders as another way to screen fraudulent transactions. The idea is that someone using a stolen credit card is less likely to have this code so they will be unable to complete the transaction. With most payment systems, you can adjust settings to automatically reject transactions where the CVV code does not match the card number.
The effectiveness of this code is limited to the ability to keep it out of the hands of criminals, which is why it is prohibited by PCI Standards from being stored. For merchants who charge customers on a recurring basis, the CVV code can be used with the initial transaction but cannot be stored for future transactions. The use of the CVV code does not affect the rate you are charged. It only helps with reducing fraudulent transactions by verifying the identity of your customers. The CVV code is not needed to handle chargeback requests. So if you're currently storing CVV numbers, it may be a good idea to reassess your procedures and delete them from your system as soon as possible. Here is a simple graph demonstrating what can and cannot be stored.
Other related posts:
PCI DSS Compliance and the cost of a credit card breach
PCI DSS Compliance basics for credit card security
Braintree solutions: The Smart Approach to PCI DSS Compliance
Comments
kiran H said on Tuesday, May 20, 2008:
This is a great article. I knew storing CVV is against PCI rules, but was trying to figure out whether is required for recurring transactions. Seems like it is not. But I dont see that documented on any of Visa, or mastercard site. Could you please clarify.
Bryan Johnson said on Friday, May 30, 2008:
@ Kiran - Here is a link to the official PCI DSS standard. On page three you'll see the permitted and non-permitted data that can be stored.
https://www.pcisecuritystandards.org/pdfs/pci_dss_v1-1.pdf
michael said on Friday, March 26, 2010:
Though it is not required for recurring transactions, our payment gateway adds a 2.5% fee if we do not provide the CVV. There seems to be no way around this?