A Razorpay CVV check is the step where the three or four digit security code entered at checkout is sent to the card issuer for verification before the payment is authorized. Razorpay passes the code from the checkout form through its gateway to the card network, the issuer returns a match or no-match response, and Razorpay relays that result to the merchant as part of the authorization outcome. The code itself is not retained after the transaction is authorized.
What the CVV check actually verifies
The card verification value is printed on the card but is not encoded in the magnetic stripe or the chip. That detail matters: it proves the person paying has the physical card in hand, which is why card-not-present transactions rely on it. The check does not confirm the cardholder's identity, the available balance, or that the card is valid for online use. Those are separate checks handled by the issuer during the same authorization request.
A Razorpay CVV check can return a match, a no-match, or no response at all. A no-response result happens when an issuer or region does not support CVV validation, and many gateways then let the transaction proceed on other risk signals.
Where the check sits in the payment flow
- The customer enters card number, expiry, and CVV on the checkout page.
- Razorpay encrypts the card data and sends an authorization request to the acquiring bank.
- The acquiring bank routes the request through the card network to the issuing bank.
- The issuer compares the submitted code with the one on file and returns a response code.
- Razorpay maps that response into a success, a failure, or a pending state for the merchant.
Common reasons a CVV check fails
- Typing errors. A transposed digit or a code copied from the wrong side of the card is the most common cause.
- Wrong card. Customers sometimes enter the number of one card and the code from another saved card.
- Issuer decline policies. Some banks decline any mismatch immediately, while others allow a limited number of retries.
- Card not enabled for online use. The issuer may block e-commerce transactions entirely, which surfaces as a generic decline.
- Tokenized or recurring payments. Once a card is registered for recurring charges under tokenization rules, the CVV is typically not requested again.
What merchants can do about failed checks
Clear error messaging reduces support tickets. Telling a customer the card verification value did not match is more useful than a generic declined message, and it prompts a retry with the correct digits. Repeated attempts on the same card can trigger velocity rules at the issuer, so it helps to limit retries and offer an alternate payment method after two failures.
Merchants should also review response codes in the Razorpay dashboard rather than assuming every decline is a CVV problem. Balance issues, expired cards, and address verification mismatches produce different codes but similar customer-facing messages.
Compliance and security notes
Payment card industry rules prohibit storing the CVV after authorization, which is why no legitimate gateway, merchant, or support agent will ever ask a cardholder to send the code by email, chat, or phone. If someone requests a CVV outside a secure checkout page, treat it as a scam. Card data should only be entered on a page served over HTTPS and processed by a PCI-compliant gateway.