3

My question is very similar to this one on SO that was closed for being off-topic there and too old to migrate, but it seems on topic here (and maybe on English Language & Usage, but it's not really English, and maybe on User Experience, but form design is not the only application, and other questions about this code are on-topic here.).

Credit cards often have a short code (e.g. 3 digits) on the back (though American Express puts 4 on the front) that helps provide some security, on some not-in-person transactions. According to DalPay, it's either CVV2, CVC2, CAV2, CID, or 4DBC. Synonym.com gives CVV, CVV2, and CVC2. Wikipedia uses CSC, also citing CVV, CVC, and SPC.

It seems to me that each form I fill out uses a different acronym or name and most just expect the reader to know "obviously" what goes in that field, like everyone uses the same term to refer to the same thing. CVV2 was on the last form.

If I were to be making a form that needed this information, what should I call it?

Improve this question
2

5 Answers 5

Reset to default
12

The "official" name depends on the card issuer, and may be trademarked. For Visa it is CVV2 (Card Verification Value). Sometimes it is called CVC2 (Card Verification Code), CID, etc etc - all the acronyms you've already found.

"2" is because it is the second one, the first being invisible to the user (encoded on the magnetic strip). The two codes are different and both may be used to verify the transactions (at least one, usually).

Transaction with the record of the CVV1 code is usually treated as "card present", while a transaction with only CVV2 will be treated as "card not present". Transaction with either will be treated more favorably than transaction without any. This is important for charge-back and fraud resolution processes. CVV1 cannot be typed in, must come from the card reader. CVV2 can only be typed in.

Improve this answer
2
  • I think the CVV1 is also encoded in the chip for those cards that can do chip+PIN transactions (when you don't swipe the mag strip).
    – Mindwin Remember Monica
    Sep 19, 2016 at 15:17
  • @Mindwin - That's actually the CVV3 (for obvious reasons). It's a different value from the other two - in fact it actually can change with each transaction (dynamic CVV). Presumably, it helps detect a chip transaction being sent in as a swipe.
    – Bobson
    Aug 11, 2019 at 2:54
5

Unfortunately, there are too many competing "official" names, as you noticed. On the forms that I create, I call it "Security Code," and I have a "What is this?" pop-up link that explains what it is with pictures for anyone that has somehow gotten this far in life without knowing what this is.

Improve this answer
2

The three digits on the back of a credit/ debit card is called the "Security Code." It's typically read as a verification that you physically have the card on you when you purchase over the phone or online. Thanks.

Improve this answer
1

It appears to me what you want is really an accepted and understandable name not an official one. However, since card brands vary as littleadv noted, I think the closest you can find to an overarching "official" definition is the Payment Card Industry Security Standards Council (R!), a consortium that develops common standards the brands and acquirers then jointly enforce.

The PCI Data Security Standard (v3.1) on page 7 defines Sensitive Authentication Data to include:

  • Full track data (magnetic-stripe data or equivalent on a chip)
  • CAV2/CVC2/CVV2/CID
  • PINs/PIN blocks

and on page 8 tags the item for CAV2/CVC2/CVV2/CID with a footnote:

The three- or four-digit value printed on the front or back of a payment card

Page 9 then describes the data to be protected in a narrative form as

... full track data, card verification codes and values (CAV2, CID, CVC2, CVV2), and PINs and PIN blocks, ...

and page 38 has the specific requirement

3.2.2 Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card used to verify card-not-present transactions) after authorization.

with applicable testing procedure

verify that the three-digit or four-digit card verification code or value printed on the front of the card or the signature panel (CVV2, CVC2, CID, CAV2 data) is not stored after authorization ...

So I'd argue "card verification code or value" is at least semi-official.

That said, on a form or UI for normal people I would use "security code" like other answers.

Improve this answer
0

If I were to be making a form that needed this information, what should I call it?

Probably a reasonable thing to do would be to copy PayPal:

PayPal CSC capture field

The text "If your card has a security code, please enter it" text only appears when you tab/click into the field; before that, it just has the "CSC (3 digits)" watermark.

Note that earlier in the form is a Card Type dropdown; selecting American Express there causes the watermark to change to "CSC (4 digits)".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .