Dynamic CVV: key technology to prevent fraud in online payments

Cards continue to lead digital payments in Latin America, especially in ecommerce. But as their use grows, so do online fraud attempts. In the face of this challenge, dynamic CVV emerges as an effective solution to enhance security in digital transactions.

What is dynamic CVV?

The dynamic CVV (Card Verification Value), also known as CVC (Card Verification Code), is a code automatically generated for each transaction or with pre-configured expiration cycles (e.g., every 1 minute, hour, or 24 hours). What is dynamic CVV?

Unlike the static code, the dynamic CVV:

• Is not printed on the card.
• Is only visible in secure environments (issuer’s app or wallet).
• Changes periodically, preventing reuse and increasing security.

How does it work internally?

When we talk about dynamic CVV, we refer to a technology backed by cryptography and real-time synchronization between two key players: the issuer (who generates the card) and the payment processor (who validates the transactions).

Every time the user makes a purchase, the system generates a unique, encrypted and ephemeral code based on a cryptographic algorithm that combines variables such as time, device, card number, and a unique shared key. This same mathematical logic is replicated on the processor's side to verify if that code is valid, without needing to store or send the original card code.

In other words: the real data is never exposed. Everything is validated with tokens and cryptographic calculations. If the code matches, the transaction is approved. If not, it is rejected. The result? A system that better protects the information, even if a malicious actor tries to intercept it. Because the code will already be expired or will not be valid on its own.

Why implement dynamic CVV in your card business?

• More protection against fraud: the code changes constantly and is useless if intercepted outside its validity period.
• User confidence: improves the perception of security and fosters loyalty.
• Fewer chargebacks, more conversions: helps reduce rejections and disputes.

Additionally, the dynamic CVV is an ideal ally for other technologies like tokenization, 3D Secure, and biometric authentication, creating a secure end-to-end ecosystem.

Our dynamic CVV solution for virtual cards

At Pomelo, we enhance the security of payments with virtual cards using a native dynamic CVV solution, directly integrated into our issuance and processing APIs. With it, our clients can define how long the code lasts, enable it by affinity group, and display it in their app for user use. With this tool, we offer greater peace of mind to both virtual card users and merchants processing the payments.

Unlike the traditional model, where the issuer and processor must synchronize, at Pomelo everything happens within the same system. This allows us to validate the CVV in real-time, frictionlessly, and with a simpler and more secure experience for users and merchants.

Benefits of our dynamic CVV solution:

• Greater anti-fraud protection: being a random code that changes periodically, it makes its misuse in online transactions difficult.
• Configurable temporal validity: the duration of the code is adjustable according to your needs.
• Adaptable configuration: easily configured, considering the segments of the card program in which you want to make it available.
• Simple integration: our API connection allows secure data exchange, delivering in real-time to your user.
• Continuity and control of the code: Adaptable to different operational flows: compatible with recurring payments, it allows invalidating or regenerating the code, among others.
• Exclusive for virtual cards: available for Visa and Mastercard virtual cards issued with Pomelo.

As part of our cloud-native and modular infrastructure, this solution adds to the rest of our security features such as 3DS, tokenization, anti-fraud engine, and multi-factor authentication.

Learn more in our documentation.