How Useful Is Card Verification Value (CVV2) for Fraud Protection?

by Dr. Ralph F. Wilson
Web Commerce Today, Issue 60, July 15, 2002

---

Starting in the late '90s, most credit cards now include a 3- or 4-digit verification number, which is not part of the regular credit card number. This system seeks (1) to make sure that the purchaser has the physical card in hand when placing a phone, mail order, or Internet order, and (2) to verify that the card account is legitimate. The number is not contained in the magnetic stripe information nor does it appear on sales receipts. These numbers go by different names:

	Name	Physical Location	Implementation Complete
Visa Picture	Card Verification Value (CVV2)	3-digits in reverse italic to the right of the cc number in the signature area on back	1/1/2001
MasterCard Eurocard Picture	Card Verification Code (CVC2)	3-digits in reverse italic to the right of the cc number in the signature area on back	1/1/1997
Discover Picture	Card Identification Number (CID)	3-digits in reverse italic to the right of the cc number in the signature area on back	unknown
American Express Picture	Card Identification Number (CID)	4-digits printed (not embossed) on the right front of the card above the cc number.	unknown
Diners Club	Card Verification Value (CVV2)	3-digit security code engraved into signature panel on back of card	unknown

But many leading online merchants don't ask for CVV2 (e.g., Amazon, Barnes & Noble, Buy.com). Shopping cart upgrades allow the merchant to ask for the CVV2 which are submitted to the processor and come back with a "match" or "no match."

When I implemented it a few weeks ago using ShopSite 6.0 and a VeriSign Payment Systems gateway, I found that American Express gives no response, while about 50% of the Visa/MC cards matched and 50% didn't match, even though transactions seemed to be quite legitimate. The system clearly isn't ready for "prime time." For now, I recommend that you monitor but not require a CVV2 match. Just consider it among other factors to determine whether a transaction might be fraudulent.

---

Other articles from Web Commerce Today, Issue 60, July 15, 2002