What is a CVV test under the PCI Data Security Standard?
A CVV test under PCI DSS is a check that card verification values are used only during the authorization request and are never stored, logged, or reused afterward. PCI DSS classifies CVV, CVC, CVC2, CID, and CAV2 as sensitive authentication data (SAD), and PCI DSS v4.0 Requirement 3.3.1 prohibits retaining SAD after authorization even when it is encrypted.
The test is a compliance check on your own payment flow, gateway configuration, and logging, not a method for checking someone else's card.
cvv test in accordance with pci dss
Which data counts as sensitive authentication data?
PCI DSS groups three data types under SAD, and the storage ban applies to all of them:
Top CVV Test Service in Compliance with PCI DSS
- Full magnetic stripe or chip track data
- CVV, CVC, CVC2, CID, and CAV2 verification values
- PINs and PIN blocks
The PAN, meaning the card number itself, may be stored if it is protected. The verification value that accompanies it may not.
What must a compliant CVV test verify?
- CVV is captured at checkout and passed to the processor only inside the authorization message.
- No CVV value appears in application logs, database columns, message queues, caches, or backups.
- Refunds, reversals, and chargeback responses are handled without resending CVV.
- Test and development environments use processor-issued test card numbers, never live account numbers.
- Recording and chat systems pause or mask capture so a spoken or typed CVV is not retained.
Can a CVV be stored if it is encrypted?
No. Encryption and hashing do not create an exception. Requirement 3.3.1 states that SAD must not be retained after authorization even when encrypted, and truncated or reversible hashes of a CVV fall under the same restriction.
If your database schema has a column labeled cvv, cvc, or cvv2, treat it as a finding until a qualified assessor confirms the column holds no live data.
How do tokenization and 3-D Secure change the test?
Network tokenization replaces the PAN with a token, which removes stored card numbers from scope, but the CVV itself still may not be retained. 3-D Secure shifts cardholder authentication to the issuer, which lowers the volume of authorization messages that carry a verification value.
How often must CVV related controls be tested?
- Quarterly external ASV scans of the cardholder data environment
- Annual penetration testing, including segmentation testing where applicable
- Annual self-assessment questionnaire or Report on Compliance
- Re-testing after any significant change to the payment channel or gateway
What are the penalties for failing a CVV control test?
Acquirers and card brands can issue fines, require a forensic investigation at the merchant's expense, and withdraw card acceptance privileges. Merchants commonly absorb the cost of reissuing compromised cards as well.
Is buying or selling CVV data legal?
No. Buying, selling, or trading CVV data is card fraud under US law and the laws of nearly every other country, and PCI DSS is a data protection standard rather than a license to trade card data. Legitimate CVV testing happens only inside your own sandbox using test credentials from your acquirer or gateway.
FAQ
Is a CVV test the same as an AVS test?
No. AVS validates the billing street address and postal code, while CVV validation checks the 3 or 4 digit verification value. Both are authorization time checks, and neither result may be stored afterward.
Can a call center agent write down a CVV?
No. Any written or digital record of a CVV after authorization is a SAD storage violation, so recording and note taking systems must suppress the value at capture.
Does PCI DSS apply to a gateway that only passes a CVV through?
Yes. Any system that transmits, processes, or could store sensitive authentication data is in scope, including service providers, and the storage ban applies to every one of them.