CVV Formats Compared by Card Brand
Card security codes are not one format. The printed verification number differs in length and position across the six major networks, and a checkout field built for three digits will reject every American Express card in the queue. This comparison sets the field rule first, then lists what each brand actually prints.
CVV Format Test: Ensuring Security When Selling CVV Online
Top pick: one numeric field, 3 to 4 characters, branched on brand
Accept a numeric string of three or four characters and branch the length requirement on the card brand prefix. Amex prefixes (34, 37) get four; every other brand gets three. This single rule covers all six networks without a second form field, and it keeps the validation logic in one place when you add a brand later.
Option: Visa, Mastercard, Discover, JCB, UnionPay, Maestro
These networks print a three-digit code on the back of the card, to the right of the signature panel. Each brand labels it differently: Visa calls it CVV2, Mastercard calls it CVC2, Discover and UnionPay call it CID, JCB calls it CAV2. The label changes; the length, position and three-digit format do not.
Option: American Express
Amex prints a four-digit code on the front, above the last digits of the card number on the right edge. It is labelled CID. Older Amex designs place it slightly higher, but the four-digit length and front placement are consistent. A three-character field truncates this code and fails authorization.
Option: Diners Club
Diners Club uses a three-digit code on the back signature panel on current issues. Legacy cards printed the code on the front. If your form already accepts three digits, the brand needs no special branch.
How to locate the code on a card
- Turn the card over and read the seven-digit block beside the signature strip.
- Take the last three digits of that block as the code for Visa, Mastercard, Discover, JCB, UnionPay, Maestro and Diners Club.
- Turn the card face up for American Express and read the four digits printed above the card number on the right.
- Confirm the brand prefix before submitting, so the length check matches the network.
What the printed code is not
The printed code is not the same value as the code encoded on the magnetic stripe or the chip. The stripe and chip carry a distinct verification value used in card-present transactions, and the chip uses a separate value again. The printed number exists for card-not-present authorization only. PCI DSS forbids storing the printed code after authorization under any circumstances, so a form should pass it to the processor and drop it, never write it to a database or a log file.
Field design notes
Set the input type to numeric, cap length at four, and disable paste trimming. Label the field generically as security code rather than CVV2, since Amex users will look for CID. Place the field next to the card number, not next to the postal code, so the visual flow matches the front of an Amex card and the back of everything else.