What is a Validation Code?
A validation code—also known as a CVV, CV2, or CVV2 code—is a series of three or four numbers located on the front or back of a credit card. It is intended to provide an additional layer of security for credit card transactions that take place online or over the phone.
Most credit card issuers place their validation codes on the back of the card, on the far-right side of the signature panel. On American Express (AXP) cards, however, the validation code is printed on the front of the card.
A validation code is one of the security measures deployed to reduce credit card fraud.
It consists of a three or four-letter code printed on the front or back of a credit card.
According to the latest Nilson Report, instances of credit card fraud have continued to rise, reaching nearly $29 billion in 2019 and projected to rise to around $38 billion by 2027, with the United States accounting for a significant portion of the most, recently reported losses, at nearly 34%.
How Validation Codes Work
As online shopping continues to grow in popularity, the threat of identity theft and other forms of credit card fraud has become increasingly severe. One measure taken to try to mitigate this risk is the use of validation codes when making credit card purchases.
In a typical transaction, a customer will be asked to provide their name, billing address, card number, expiration date, and validation code. Although many of these details, such as the name and address, could be obtained from other sources; the card number, expiration date, and validation code can theoretically only be obtained from possessing the card itself.
As an added measure, the validation code is generally printed on the back of the card, making it more difficult for would-be thieves to glean all the necessary information from a single photograph of the credit card.
To further enhance these security measures, consumer protection laws prevent merchants from storing customers’ validation codes after a purchase has been made—although unscrupulous sellers may still record this information illegally. An additional measure of protection is provided by the personal identification numbers (PINs) which cardholders must enter when making payments using point-of-sale (POS) terminals.
Types of Validation Codes
The following are the main types of validation codes:
The CVC1/CVV1 code is printed on track two of the magnetic strip. It is used by merchants in “card-present transactions” when the customer is physically present at the point of sale.
This code is automatically retrieved when the card is swiped on a point-of-sale system and authorized by the issuer. It verifies that the owner of the card is physically present at the point of sale.
The CVV2/CVC2 is used in “card-not-present” transactions, where the customer is not physically present at the point of sale. It is used to verify payment transactions that occur online, by email, telephone, or on e-commerce websites.
The customer is required to input the validation code before a payment transaction is authorized. If it is not provided during the transaction, the payment is automatically rejected.
How Does a Validation Code Protect Customers?
When making a purchase online, you will be required to enter the name as displayed on the debit/credit card, the billing address, card number, card expiration date, and the CVV. If the CVV is incorrect or missing, the transaction cannot be completed.
After a customer makes a purchase, merchants are not allowed to store card validation codes to provide extra protection against theft of debit/credit cards. Also, validation codes can be compromised as fraudsters can secure the validation code of a card just as they can access the card number and expiry date.
The validation code is a key piece of data that can enable thieves to make fraudulent transactions with someone else’s card. However, if a thief does use another user’s card, it’s unlikely that the cardholder will be held responsible for the charges.
Where to Find the Validation Code
The validation code is typically a three or four-digit number that is printed on the signature strip on the back of a credit card. When using a VISA, MasterCard, or Discover credit or debit card, it is the final cluster of numbers that is printed on the back signature panel on the back of the card.
A card’s signature panel contains a series of digits. The last three digits are the validation codes. On American Express cards, the code is located on the front of the card towards the right side, above the account card number.
How Validation Codes Prevent Fraud
When a customer goes online and buys a product or service, they are required to provide their personal information, physical address, and credit card details such as card number, expiration date, and validation code. If any of this information is incorrect, the payment is automatically rejected.
Most merchant sites may save the information on the database – except the validation code – to make it easier for customers to make transactions in the future.
Usually, a customer may not know the validation code of a card unless it is in their possession. The validation code is an important piece of data that can prevent cyber thieves from using another person’s card to make fraudulent online transactions. If a customer loses their credit or debit card, they are required to immediately alert the card issuer who then blocks the card to prevent misuse.