Card Security Code - Types of Codes

Types of Codes

There are several types of security codes:

• The first code, called CVC1 or CVV1, is encoded on the magnetic stripe of track-2 of the card and used for transactions in person. The purpose of the CVC1 or CVV1 is to ensure the data stored on the magnetic stripe of the card is valid and was generated by the issuing bank. This value is submitted as part of transactions and is verified by the issuing bank. A limitation of the CVC1 or CVV1 is that if the entire magnetic stripe is copied, rather than generated, the card can be duplicated. See the Skimming section, in the article Credit card fraud, for more details.
• The second code, and the most cited, is CVV2 or CVC2. This CSC (also known as a CCID or Credit Card ID) is often asked for by merchants for them to secure card not present transactions occurring over the Internet, by mail, fax or over the phone. This code was first put into use by American Express Company in 1999 - 2000 in response to growing internet transactions and card member complaints of spending interruptions. In some countries in Western Europe, card processors require the merchant to provide this code when the cardholder is not present in person.
• Contactless card and chip cards may supply their own codes generated electronically, such as iCVV or Dynamic CVV.

These codes should not be confused with the standard card account number appearing in embossed or printed digits. (The standard card number undergoes a separate validation algorithm called the Luhn algorithm which serves to determine whether a given card's number is appropriate.)

These codes should also not be confused with a card's PIN or passwords associated with MasterCard SecureCode or Verified by Visa. These codes are not printed or embedded in the card but are manually entered by the cardholder at the time of transaction.