CVV2/CVC2 CID Response Codes

Expected values -- 3 digits for VISA, MasterCard and Discover & 4 digits for AMEX -- variance can impact responses.



Card Verification Indicator



Indicator   Description

Expected CVV2/CVC2/CID Responses

V/MC/DS

Value Controls Response

VISA

(Last Digit Controls   Response)

MasterCard (Third Digit Controls Response)

Discover (Third Digit Controls   Response)

AMEX

Value Controls Response

AMEX** (Last Digit Controls Response)

0

Bypassed

(in request)

n/a

P

{blank}

{blank}

n/a

{blank}

1

Present

(in request)

xx1

M

M

M

xxx1

M

1

Present

(in request)

xx2

N

N

N

xxx2

N

1

Present

(in request)

xx3

U

U

U

xxx3

P

1

Present

(in request)

xx4

P

P

P

xxx4

{Blank}

1

Present

(in request)

xx5

M

M

M

xxx5

M

1

Present

(in request)

xx6

N

N

N

xxx6

N

1

Present

(in request)

xx7

M

M

M

xxx7

M

1

Present

(in request)

xx8

N

N

N

xxx8

N

1

Present

(in request)

xx9

M

M

M

xxx9

M

1

Present

(in request)

xx0

M

M

M

xxx0

M

1

Present

(in request)

xx *

N

N

N

xx *

N

2

Illegible

(on card)

n/a

P

{blank}

{blank}

n/a

{blank}

9

Not present

(on card)

n/a

S

{blank}

S

n/a

* This two digit value sample has the third digit (and any fourth digit) as a blank space

** AMEX Keyed Transactions Only -- NO CID response currently on Swiped or Proximity entry

Response value descriptions:

  • M = Match

  • N = No match

  • P = Not Processed

  • S = Issuer indicates that CVV2 data should be present on the card, but the merchant has indicated that the CVV2 data is not present on the card.

  • U = Issuer not certified or registered to process card verification

error_outline

note

Due to format requirements in different specifications, the descriptor of "Last Digit" vs. "Third Digit" is used to define how developers and testers can control responses within the test environment -- this does NOT reflect card issuer response controls in production -- Test Environment response control only.

Presentment of ANY alpha characters in the CVV2 values results in a test simulator response = P -- Not processed.