Can a merchant store the CVV?
No. A merchant cannot store the CVV after authorization. The PCI Security Standards Council classifies card verification codes as sensitive authentication data, which must not be kept once the authorization is complete, even encrypted and even with the customer’s consent. Card-on-file and recurring payments therefore run without a CVV.
In detail
No. This is one of the clearest rules in PCI DSS, and it applies to every merchant and service provider.
What the rule says
The PCI Security Standards Council states that card verification codes are sensitive authentication data. They cannot be stored after authorization, even if encrypted, and even if the customer agrees. The rule covers databases, logs, call recordings, emails and paper forms.
What this means in practice
- Checkout: the code is captured in a hosted field, used for one authorization, then discarded.
- Card-on-file: a returning customer may be asked for the CVV again, or the merchant can skip it.
- Recurring payments: merchant-initiated transactions are sent without a CVV. Issuers expect this when the transaction is flagged correctly, as explained in CIT vs MIT.
- Phone orders: agents must not write the code down, and recordings must not capture it.
The code is meant to show that the buyer has the card. If it were stored with the card number, a single data breach would give thieves everything needed to pay online.
Tokenization does not change the rule: a token replaces the card number, never the CVV. See AVS and CVV. Using a hosted smart checkout keeps the code away from the merchant’s systems.