In addition to checking the format of basic sanity (for example, 3 or 4 digits depending on the card), CVV can be confirmed by approving / authorizing the payment , which must be carried out by your payment processor. See the Transaction Types documentation at .. drum roll .. authorize.net.
The Luhn checksum (or similar) used for the card number is designed to detect simple human input errors, such as number transfers, and does not guarantee that the number is valid - simply that it can be valid. There is no need to have a similar CVV checksum due to the small size (3 or 4 digits), and this will reduce the value space that will defeat the CVV target somewhat.
Oh, and please don't say you keep CVV? This is very bad: - (
Happy coding.
user166390
source share