Card security codes — CV, CVV, CVV2, CSC, or CID depending on the network — are the three- or four-digit values printed on a card that exist specifically to prove the person checking out actually has the physical card in hand. The code is generated from the card's account number through a cryptographic algorithm and seed value, and critically, it never appears on receipts or in the card's magnetic stripe data.
What it actually confirms
A card security check validates two things at once: that the checkout is happening with the physical card present, and that the account itself is legitimate. The response is simply match or no-match.
The real tradeoffs
- Some customer confusion — expect a modest uptick in support requests and calls
- A measurable, if modest, dip in conversion
- Your payment processor has to support passing the field through
The recommended approach is to auto-decline on a mismatch while giving legitimate customers a phone channel to reorder. Despite reducing fraud attempts measurably, most merchants still don't check it — adoption is higher in Mail Order/Telephone (MOTO) channels than in eCommerce, and UK eCommerce merchants specifically aren't advised to rely on it.
Cost-wise, there's nothing beyond updating your checkout form to capture the field and confirming your payment stack passes it through.