CVV2/CVC2 CID Response Codes
Expected values -- 3 digits for VISA, MasterCard and Discover & 4 digits for AMEX -- variance can impact responses.
Card Verification Indicator |
Indicator Description |
Expected CVV2/CVC2/CID Responses | |||||
---|---|---|---|---|---|---|---|
V/MC/DS Value Controls Response |
VISA (Last Digit Controls Response) |
MasterCard (Third Digit Controls Response) |
Discover (Third Digit Controls Response) |
AMEX Value Controls Response |
AMEX** (Last Digit Controls Response) | ||
0 |
Bypassed (in request) |
n/a |
P |
{blank} |
{blank} |
n/a |
{blank} |
1 |
Present (in request) |
xx1 |
M |
M |
M |
xxx1 |
M |
1 |
Present (in request) |
xx2 |
N |
N |
N |
xxx2 |
N |
1 |
Present (in request) |
xx3 |
U |
U |
U |
xxx3 |
P |
1 |
Present (in request) |
xx4 |
P |
P |
P |
xxx4 |
{Blank} |
1 |
Present (in request) |
xx5 |
M |
M |
M |
xxx5 |
M |
1 |
Present (in request) |
xx6 |
N |
N |
N |
xxx6 |
N |
1 |
Present (in request) |
xx7 |
M |
M |
M |
xxx7 |
M |
1 |
Present (in request) |
xx8 |
N |
N |
N |
xxx8 |
N |
1 |
Present (in request) |
xx9 |
M |
M |
M |
xxx9 |
M |
1 |
Present (in request) |
xx0 |
M |
M |
M |
xxx0 |
M |
1 |
Present (in request) |
xx * |
N |
N |
N |
xx * |
N |
2 |
Illegible (on card) |
n/a |
P |
{blank} |
{blank} |
n/a |
{blank} |
9 |
Not present (on card) |
n/a |
S |
{blank} |
S |
n/a |
* This two digit value sample has the third digit (and any fourth digit) as a blank space
** AMEX Keyed Transactions Only -- NO CID response currently on Swiped or Proximity entry
Response value descriptions:
-
M = Match
-
N = No match
-
P = Not Processed
-
S = Issuer indicates that CVV2 data should be present on the card, but the merchant has indicated that the CVV2 data is not present on the card.
-
U = Issuer not certified or registered to process card verification
note
Due to format requirements in different specifications, the descriptor of "Last Digit" vs. "Third Digit" is used to define how developers and testers can control responses within the test environment -- this does NOT reflect card issuer response controls in production -- Test Environment response control only.
Presentment of ANY alpha characters in the CVV2 values results in a test simulator response = P -- Not processed.