CVV (Card Verification Value), also generally known as CVC (Card Verification Code) or CSC (Card Security Code) or CID (Card Identification Number), depending upon the card network, is a 3- or 4-digit numeric security code that is printed on a credit or debit card. It is used as a cryptographic check to confirm that the person making a Card-Not-Present (CNP) transaction (e.g., booking a flight online or via telephone) is actually in possession of the physical card, rather than having the card number stolen from a database or receipt.
In the travel industry, where the majority, if not all, of the transactions occur remotely (online or through call centers), fraud is a constant threat. The CVV is the main protection against breaching of the database.
If a database of credit card numbers is stolen from a hotel’s old server by a hacker, he or she usually has the 16-digit Primary Account Number (PAN) and the expiry date. Due to regulations on payment, which absolutely prohibit storing the CVV, the hacker’s stolen database will not have this code. When they try and use the stolen numbers to purchase a plane ticket, the airline’s payment gateway will ask for the CVV. The hacker is not able to provide it, and the transaction is declined.
For travel agents and hotel front desk staff, the CVV is a huge operational challenge because of PCI DSS (Payment Card Industry Data Security Standard) regulations.
A merchant can ask for the CVV to authorize a transaction in the moment, but they can never store it after it’s been authorized. It cannot be written in the Notes field of a GDS PNR, saved in a Property Management System (PMS) profile, or written in a paper authorization form stored in a filing cabinet.
Should a travel agency be found storing CVVs (even on sticky notes), the travel agency faces massive fines and could lose their ability to process credit cards altogether. This causes friction for “guaranteed” bookings where a hotel wants to charge a no-show fee months after the fact but cannot legally retain the code to do so.
While the function is the same, this format varies from network to network, which causes confusion for travelers and new agents:
They use the card for the initial Auth (Authorization) check, to make certain that the card is valid and that there is money on it. Once the bank says “Approved”, the hotel’s system creates a Token (see PCI DSS) for future charges and will discard the real CVV.
No. There is a CVV1 that is encoded in the magnetic stripe for in-person swipes. The CVV2 is the number printed on it for use over the Internet. They are different codes, so by cloning magnetic stripes, a fraudster will not have the code to shop online.
The transaction is normally rejected by the issuing bank immediately with a Do Not Honor or Invalid Security Code message. Repeat failure will often result in a lock and a fraud alert on the card.
Leave your request
We will contact you shortly
Thank you for your request!
We will get back to you as quickly as possible
