Verifying payment card data

The Visa International Service Association (VISA) and MasterCard International, Incorporated have specified a cryptographic method to calculate the VISA card-verification value (CVV) and the MasterCard card-verification code (CVC). This value relates to the personal account number (PAN), the card expiration date, and the service code and is used to detect forged cards. The CVC can be encoded on either track 1 or track 2 of a magnetic-striped card. Because most online transactions use track-2, the ICSF callable services generate and verify the CVV¹ by the track-2 method.

The VISA CVV service generate callable service calculates a 1- to 5-byte CVV. This value results from using two data-encrypting keys to DES-encrypt the PAN, the card expiration date, and the service code. The VISA CVV service verify callable service calculates the CVV by the same method. The service compares the CVV it calculates to the CVV supplied by the application (which reads the credit card's magnetic stripe). The service then issues a return code that indicates whether the card is authentic.

The Transaction Validation callable service can be used to generate and verify American Express card security codes (CSC). The service supports 3, 4, and 5 character codes and versions 1.0 and 2.0 algorithms.