Understand CVV

In the card-not-present sales environment, CVV2 is an excellent tool for verifying that the customer has a legitimate credit card in hand at the time of the sales order.

The customer contacts the merchant to place an order.
On your payment page you ask the customer for the CVV2 code and send it to the card issuer as part of the authorization request.
The card issuer checks the CVV2 code to determine its validity, and then sends a CVV2 result code back to the merchant along with the authorization decision.
Before completing the transaction, the merchant evaluates the CVV2 result code, taking into account the authorization decision and any other relevant or questionable data. A merchant may also verify CVV2 without an accompanying authorization request by using the $0 Account Verification Message, which is available in some regions
Because card-not-present transactions are at greater risk for stolen account number schemes, you need to be diligent in your fraud control efforts. CVV2 can help you differentiate between good customers and fraudsters who operate anonymously. It allows you to make a more informed decision before completing a non-face-to-face transaction.

Reduced Chargebacks: Using CVV2 potentially reduces fraud-related chargeback volume. Reduced fraud-related chargebacks translate into maximized profitability.
Improved Bottom Line: For card-not-present merchants, fraudulent transactions can lead to lost revenue and can also mean extra processing time and costs, which often narrow profit margins. CVV2 complements the merchant‘s current fraud detection tools to provide a greater opportunity to control losses and operating costs.

Understand status codes

After obtaining the card CVV2 Result Code, Account Number, and Card Expiration Date:

Send the CVV2 presence indicators as requested in the programmers guide along with other required authorization data (i.e. account number, expiration date and transaction amount).
After receiving a positive authorization response, evaluate the CVV2 result code and take appropriate action based on all transaction characteristics.
M – Match
Complete the transaction (taking into account all transaction characteristics and any questionable data).
N – No Match*
View the “No-Match” as a sign of potential fraud and take it into account along with the authorization response and any other questionable data. Potentially hold the order for further verification.
P – Not Processed
View the “Not Processed” as a systemic technical problem or the request did not contain all the information needed to verify the CVV2 code. Resubmit the authorization request.
S – CVV2 should be on the card
Consider following up with your customer to verify that he or she checked the correct card location for CVV2. All valid cards are required to have CVV2 printed either in the signature panel or on a white box to the right of the signature panel.
U – Issuer does not participate in the CVV2 service
Evaluate all available information and decide whether to proceed with the transaction or investigate further.
X – Issuer did not respond
Evaluate all available information and decide whether to proceed with the transaction or investigate further.
0 – No service available
The acquirer does not provide the CVV2 service. Evaluate all available information and decide whether to proceed with the transaction or investigate further.

Additional Information

The use of the Card Verification Value is one of the basic fraud control actions. If the CVV2 service is available, obtain the CVV2 three or four-digit code from the cardholder. An issuer-validated CVV2 code is a good indicator that the card is genuine.