Identifier detector
Card security code (CVV/CVC): format, validation and detection
Short answer
A card security code is three or four digits with no checksum. Maskflare can only detect it by context: it masks a short digit run that follows words like CVV, CVC, CVC2 or card verification.
What it is
The CVV/CVC code printed on a card is in the Global pack under card security codes. The PCI DSS compliance profile requires the card_cvv rule, and the other profiles include the Global pack.
In Maskflare this is the detector card_cvv, labelled "Card security code (CVV/CVC)", category card security code, in the Global pack.
Format and layout
- Three digits, or four on some card types.
- No separators.
How the check works
There is no check digit and no validator: the detector has none. Any 3 or 4 digits after a trigger word can match.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
123 | Valid | Matches the layout and passes the validator. |
In running text the valid example reads, for instance, CVV: 123.
Regex and validation caveats
- The catalogue lists eight trigger words, among them cvv, cvc, cvc2, cid and card verification. Without one of them nearby, three digits are not masked, because they would match countless ordinary numbers.
- The words must come before the digits within 48 characters.
- A code that is written without any label, for example in a table column, is not detected.
Words that confirm it
The detector masks a match only when one of its keywords appears within 48 characters before the value. The catalogue lists 8: card code, card verification, cid, cvc, cvc2, cvv, cvv2, security code.
How to detect it in LLM traffic
A security code usually arrives next to a card number in the same message or table row, so it travels with the number it protects. Support transcripts and payment-failure tickets are common sources.
Because the code has no check digit, Maskflare relies on the label in front of it. A code in a table column with no label is out of reach of this rule, which is one reason to pair it with the card number detector and with policies that keep card data out of prompts.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Card security code (CVV/CVC) candidates.
- Apply the layout rules from the section above. This identifier has no check digit to recompute, so expect more look-alikes than with a checksum-based format.
- Require one of the words listed above shortly before the value. Maskflare looks back 48 characters.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token).
- Monitor first: alert (counted, forwarded unchanged).
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
All 6 compliance profiles include the Global pack, and applying them turns this detector on: HIPAA Safe Harbor, GDPR - EU/EEA, UK GDPR, PCI DSS, US personal data and Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Can a CVV be detected without a keyword?
No. Three or four digits with no checksum cannot be told apart from other numbers, so Maskflare requires a trigger word.
Is the CVV rule part of PCI DSS in Maskflare?
Yes. The PCI DSS profile lists card_cvv as a required rule, with the default minimum action of mask.
Is the Card security code (CVV/CVC) detector on by default?
Yes. It belongs to the Global pack, which the default Protect now template turns on with the action mask.
Does a valid Card security code (CVV/CVC) prove the person exists?
No. This identifier is validated on its layout alone, so a passing value is only well formed, not known to be real.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.