CVV Numbers (by Graham King)

CVVs, CVV2s, CVCs, and Indent CVCs are 3-digit Card Verification Values or Card Verification Codes that are all calculated using the same CVV algorithm. These values are required by payment systems such as Visa and MasterCard to authenticate their credit or debit cards. Different names are used to refer to the values depending on the particular payment system, the location of the value on the card, and the parameters passed to the CVV algorithm.

To calculate a 3-digit CVV, the CVV algorithm requires a Primary Account Number (PAN), a 4-digit Expiration Date, a 3-digit Service Code, and a pair of DES keys (CVKs).

Besides the obvious CVV variations provided by different PANs and expiration dates, most card issuers will use different CVKs for different batches of cards. Cards can be grouped by bank, by ATM network, or by other means of identifying a certain group of cards. Cards in the same batch will often use the same service code. This service code to the CVV algorithmis usually non-zero. One CVV variant, now commonly called CVV2 (Visa), or Indent CVC (MasterCard), uses ‘000’ as the service code parameter to the CVV algorithm. Sometimes a card will have both a traditional CVV and a CVV2.

Another variation to the CVV algorithm can be introduced by changing the format of the expiration date. While the date is always the concatenation of the 2-digit month (MM) andlast 2 digits of the year (YY), it can be in either YYMM or MMYY formats. For instance, Visa CVV2s are usually calculated using the YYMM format.

Author: Graham King