CVC / CVV (Card Verification Code)
The short security code printed on a payment card, used to check that the person paying is holding the physical card.
A CVC, or Card Verification Code, is the short number printed on a payment card that is never stored in the magnetic stripe or chip. Visa calls it CVV2, Mastercard calls it CVC2, and American Express prints a four-digit code on the front rather than three on the back. They all serve the same purpose.
The code exists to answer one narrow question: is the person entering the card details actually holding the card? Because it is not embossed and not part of the stored account data, a code stolen from a breached database of card numbers usually will not include it. That makes a CVC check one of the cheapest signals available on a card-not-present sale.
Two practical points matter for merchants. First, you may never store the CVC after a transaction is authorized, even encrypted, and doing so is a direct PCI DSS violation that can put your account at risk. Second, a matching CVC proves possession, not identity. It will not stop a fraudster who has the physical card or the full details from a phishing page, which is why it works best alongside AVS and a wider fraud review rather than on its own.