If you sell online and you are choosing a payment gateway, CVV authentication is the part of checkout you cannot treat as an optional setting. Razorpay runs the CVV check inside its own hosted card form and inside the issuing bank 3D Secure page, so your servers never receive or keep the three digit code. The real buying decision is not how to capture CVV data. It is how to pick a gateway that enforces authentication, supports network tokenization, and keeps you inside PCI DSS and RBI rules. Anyone offering to sell, trade, or rent CVV data is operating outside those rules, and paying for that data carries card network fines, chargeback liability, and criminal exposure.
How CVV authentication works at Razorpay
The CVV (card verification value) is the three digit code printed on the back of most Visa, Mastercard, and RuPay cards, and the four digit code on the front of American Express cards. It proves the person entering the card number physically holds the card at that moment. Razorpay collects it in a PCI DSS compliant input field, passes it to the card network for verification during authorization, and discards it. It is never returned to the merchant dashboard, never included in webhooks, and never stored in your database. For Indian card transactions, a second factor is added through the RBI mandate for additional factor authentication, which in practice means a one time password or an in app approval on the cardholder phone.
What to look for before you commit to a gateway
- CVV fields rendered in the gateway iframe or hosted page, not on your own checkout template
- 3D Secure 2 support with device fingerprinting and frictionless flow for low risk payments
- Network tokenization enabled by default so repeat customers pay without re entering the card
- Clear documentation stating that CVV and full card numbers are out of scope for your servers
- Signed PCI DSS attestation and a current SAQ A or SAQ A EP eligibility statement
- Webhook events that carry a token reference, not raw card data
Reasonable parameter bands
- CVV length: 3 digits for Visa, Mastercard, RuPay, and Discover, 4 digits for American Express
- Authentication step time: a few seconds for frictionless 3DS 2, up to about a minute when an OTP is required
- Retry window: allow two to three attempts before falling back to another payment method
- Token lifetime: managed by the card network, not by you, so never build logic that assumes a fixed expiry
- Reconciliation cycle: match settlements daily so failed authentication does not sit unresolved for weeks
Common pitfalls
- Asking customers to read their CVV over the phone or send it by email or chat
- Logging the payment request body in full, which can leak sensitive authentication data
- Treating a CVV match alone as proof of identity when the transaction still needs a second factor
- Buying card data from a marketplace, which is card fraud regardless of where the seller claims the data came from
- Assuming tokenization removes all PCI obligations rather than shrinking them to a smaller scope
FAQ
Can I store a customer CVV after a payment?
No. PCI DSS forbids retaining sensitive authentication data after authorization, and RBI rules for Indian merchants align with that. Delete it if it ever reaches your systems.
Does Razorpay show the CVV to merchants?
No. The code goes to the network for verification and is not exposed in reports, dashboards, or API responses.
Razorpay CVV Authentication Process: A Comprehensive Guide
Does tokenization remove the need for CVV?
For a saved card, a network token plus a cryptogram replaces the card number and CVV, so the customer does not retype either one. The first payment still requires CVV and authentication.
What happens if authentication fails?
The authorization is declined. Let the customer retry, then offer a different card or an alternate method such as UPI or net banking.