Card Validation Tools Documentation

Introduction

Card security codes are short numeric values printed on a card or computed dynamically that prove the cardholder physically possesses the card or a valid token. They’re the first line of defence in card-not-present transactions and are checked on every authorisation alongside expiry date and address verification.

ISO8583Studio includes dedicated calculators per scheme so you can simulate issuer behaviour without an HSM and validate codes returned by your authorisation pipeline.

Key Concepts

Code	Scheme	Where it lives	Length
CVV	Visa	Magstripe (track 1 / 2)	3 digits
CVV2	Visa	Card back (signature panel)	3 digits
iCVV	Visa	EMV chip	3 digits (computed with service code 999)
CVC	MasterCard	Magstripe	3 digits
CVC2	MasterCard	Card back	3 digits
CVC3	MasterCard PayPass	Computed dynamically per tap	3 digits
CSC	American Express	Card front	4 digits

Visa CVV / CVV2 Calculator

A two-tab tool: Generate and Validate.

Inputs

PAN — Up to 19 digits.
Expiration Date — YYMM format.
Service Code — 3-digit value. Use 000 for CVV2, the actual service code for magstripe CVV, or 999 for iCVV.
CVK / CVV Key — 32 hex chars (2-key 3DES).

Generate Tab

Enter PAN, expiration, and service code.
Enter the CVK.
Click Generate. A 3-digit CVV is produced.

Validate Tab

Enter the same parameters plus the CVV value to check. The tool re-computes and compares.

CVV / CVV2 / iCVV by service code

The same algorithm produces all three Visa codes — what differs is the service code input: real service code for CVV, 000 for CVV2, 999 for iCVV. One key, three values.

Example

PAN:        4111111111111111
Exp:        2812
Service:    000          (CVV2)
CVK:        0123456789ABCDEFFEDCBA9876543210

CVV2:       123

MasterCard CVC Calculator

The MasterCard CVC tool covers static CVC2 and dynamic CVC3 (PayPass).

Static CVC2

Algorithmically equivalent to the Visa CVV with MasterCard’s key arrangement. Inputs:

PAN
Expiration (YYMM)
Service Code — 000 for CVC2.
CVC Key — 32 hex chars.

Dynamic CVC3 (PayPass)

CVC3 is computed for each contactless transaction by combining a CVC3 master key, the unpredictable number from the terminal, and the Application Transaction Counter (ATC).

UN — 8-digit unpredictable number from the terminal.
ATC — 4-hex-char application transaction counter.
Track Data — Track 1 / Track 2 template.
CVC3 Master Key — 32 hex chars.

CVC3 placement

The 3-digit CVC3 replaces the discretionary data positions in the magstripe-equivalent track output the contactless card emits. Combined with the ATC, every tap produces a unique track 2.

AMEX CSC Calculator

American Express uses a 4-digit Card Security Code (CSC), printed on the card front above the embossed PAN.

Inputs

PAN — 15 digits.
Expiration Date — YYMM.
CSC Key — 32 hex chars.
CSC Position — Some processors expect leading zeros padded; the tool exposes both 4-digit raw and zero-padded outputs.

Operations

Generate — Produce the CSC for a given PAN + expiration.
Validate — Check a presented CSC against the expected value.

Service Codes

The 3-digit service code is fed into CVV/CVC algorithms. Each digit has independent meaning:

Position	Common Values	Meaning
1st digit	1, 2, 5, 6, 7, 9	Interchange and technology (international, EMV, etc.).
2nd digit	0, 2, 4	Authorisation processing (online, offline, by issuer).
3rd digit	0–7	Range of services and PIN requirement.

101 — International, normal authorisation, no restrictions.
201 — Same but EMV-capable.
120 — Online authorisation only, PIN required.
999 — Special value used by Visa for iCVV computation.
000 — Special value for CVV2 / CVC2.

Tips

Use the same CVK / CVC key for CVV, CVV2, and iCVV — only the service code changes.
If your CVV2 doesn’t match across systems, check whether the integrator strips the trailing PAN check digit before computation. Different specs handle that differently.
For CVC3 testing, capture the UN and ATC from your terminal log alongside the track data — off-by-one ATC is a common error.