CVV or CVC is a 03-digit or 04-digit code printed on the rear side or the front side of a Payment Card (Credit Card, Debit Card, Pre-Paid Card, etc).It’s an additional security feature offered in Payment Cards to ensure that only the genuine physical holder of the card can use it and that someone who has gotten only the card number and some personal information cannot provide this value without the actual physical card.
CVV/CVC was initially introduced in magnetic stripe cards, where it is called as`CVV1` or `CVC1`. It is a cryptographic combination of the Card Number (PAN), Expiry date and Card Service Code (a 3-digit code to define the Card Issuer’s rules on the Card. Ex. Limit to International or Domestic use, Online or Offline authorization, PIN required). CVV1/CVC1 is stored in the magnetic stripe, together with the Card Number, Expiry Date and Card Service Code. At the time of a transaction, the magnetic stripe reader of the Terminal reads the information from the Card Mag Stripe and transmits in the Authorization request. The Cryptographic Key used to generate and validate the CVV1/CVC1 is called asCard Verification Key 1 (CVK1).
Later, another CVV/CVC known as`CVV2` or `CVC2`was introduced, in order to check the integrity of E-Commerce transactions. because (normal) humans cannot read the CVV1/CVC1 information in the mag-stripe. This code is visible on the physical card and must be used to perform Card Not Present (CNP) transactions. The same algorithm of CVV1/CVC1 is used to generate CVV2/CVC2 with a different Cryptographic Key named asCard Verification Key 2 (CVK2).
When EMV technology came in to the picture, another CVV/CVC code was introduced and named as CVC3/CVV3 or iCVV (Integrated Chip Card Verification Value).This value is stored inside the EMV chip under the EMV Tag of 57. The same algorithm of CVV1 and CVV2 is used to generate the iCVV. However, instead of the real Card Service Code, ‘999’ is used as the Card Service Code when generating the iCVV with a different Cryptographic Key named asiCard Verification Key (iCVK).
Instead of having a static code as the CVV/CVC, the latest update is dynamic CVV which is called as dCVV. It creates a new value periodically. There are two types of generating a dCVV:
1.When a customer is ready to initiate a transaction, the customer can request for a dCVV and the Card Issuer delivers the same to the Customer’s registered SMS or E-mail. It’s like one-time password and expires soon after the transaction or within a stipulated time period.
2.Small electronic screens are embedded directly onto the back of the card, and the code changes every 30-60 minutes. Below is a sample dCVV card embedded a small digital screen to generate the dCVV.
The dCVV Cards with a digital display is not a new thing into the Payments market. Due to the cost of the physical cards, this has not been popular.
Different names used by the Payment Schemes for CVC/CVV
Calculating the CVV1, CVV2, iCVV
1.Concatenate the PAN, expiry date and service code and pad right with zeros to get 16-bytes (32 Hexadecimal string) key value
4123121234567891 + 2312 + 201 + 000000000 = 41231212345678912312201000000000
2.Split the result Key of step 1 into 2 blocks
Block 1= 4123121234567891
Block 2= 2312201000000000
3.Take the 16-Byte (32 Hexadecimal) CVV Key and split into 2 Blocks
CVV Key = 1234567890ABCDEF5678901234ABCDEF
Block 1= 1234567890ABCDEF
Block 2= 5678901234ABCDEF
4.Encrypt Block 1 of Step 02 by using the Block 1 of Step 3 (DES algorithm)
Encrypt 4123121234567891 by 1234567890ABCDEF
Result = 453E04E1ACAAE2BB
5.Perform XOR on the result of Step 4 with Block 2 of Step 2
453E04E1ACAAE2BB XOR 2312201000000000
Result = 662C24F1ACAAE2BB
6.Encrypt the result of Step 5 by Block 1 of Step 3 (DES algorithm)
Encrypt 662C24F1ACAAE2BB by 1234567890ABCDEF
Result = E188C879876B95C3
7.Decrypt the result of Step 6 by Block 2 of Step 3 (DES algorithm)
Decrypt E188C879876B95C3 by 5678901234ABCDEF
Result = 1D64BCD5CD791E95
8.Encrypt the result of Step 07 by Block 1 of Step 3 (DES algorithm)
Encrypt 1D64BCD5CD791E95 by 1234567890ABCDEF
Result = 96C0C9362DE4768A
9.Extract all numeric digits from the result of Step 8
Result = 96093624768
10.Get the first 3 numeric of the result of Step 9 and it the calculated CVV/CVN
Result = 960 is the calculated CVV/CVN
