Can you store CVV codes?
No. Here's why — and what to do instead.
This is the shortest guide we publish, because the answer has no nuance: after a transaction is authorized, you may not store the card security code. In any form. Encrypted or not. Not in a spreadsheet, not in a locked drawer, not in a call recording, not "just until the second charge." PCI DSS requirement 3.3.1 is the brightest line in the entire standard. Here's why the rule is absolute, where CVVs hide anyway, and why you never needed to keep them.
Why this rule has no exceptions
The three-digit code exists to answer exactly one question: does the person making this purchase have the physical card in their hand, right now? It works only because it isn't stored anywhere except the card itself — not even your bank keeps it. The moment a merchant writes it down, the code stops proving possession and starts being a skeleton key: a stolen card number alone fails at most online checkouts, but a number with its CVV sails through. A stored CVV doesn't just create risk for you — it quietly breaks the security model for every other business that card visits. That's why the standard allows encryption for stored card numbers but offers storage of the CVV no path at all.
The only narrow allowance: data captured before authorization completes — the seconds while a charge is being processed — after which it must be gone. "We keep it until the deposit clears next week" is already on the wrong side of the line.
The five places CVVs hide in small businesses
The spreadsheet column. Helpfully labeled CVV, right beside the card numbers. If you have the file, you almost certainly have the column — and it converts the file from a violation into a ready-to-use fraud kit.
The authorization form. Many templates floating around the internet include a security-code field. Every signed copy in the binder is stored SAD — one more reason the paper form should go entirely.
The emailed PDF. The customer typed all three digits into the fillable form and pressed send. Now it's in their sent folder, your inbox, and every backup of both.
The CRM notes field. "Card ending 1111, exp 12/28, code 831 — ok to charge monthly." Free-text fields are where compliance goes to die, because no scanner is looking there.
The call recording. "For quality and training purposes" — and if the customer reads their card aloud, the recording now stores the CVV in audio. Recordings are storage; the rule applies to them too.
The part nobody tells you: you never needed it
Businesses keep CVVs for one reason: they believe the next charge will require it. It won't. Card networks distinguish the first, customer-present transaction — where the CVV does its one job — from the follow-on charges you run against a properly stored credential, which are processed without it. Every subscription you've ever had worked this way; no streaming service asks for your code each month. Here's the full guide to billing on file without storing anything.
What to do this week
Hunt the column. Search your spreadsheets, CRM notes, and shared drives for three-digit codes sitting near card numbers. Delete the codes first — that single edit removes the worst of the exposure even before the numbers themselves are dealt with.
Stop collecting it in writing. Remove the CVV field from any form you hand out, and tell customers plainly: we will never ask you to write down your security code. It's a trust signal your competitors' forms are failing.
Replace the workflow that "needs" it. Card into the vault once — via a secure request link or hosted capture — then charge the token on schedule. The CVV does its job at capture and is never retained by you or anyone else.
Frequently asked questions
Can we store the CVV if it's encrypted?
No. Requirement 3.3.1 prohibits retention after authorization in any form — encryption creates no exception. Card numbers may be stored unreadable; the CVV may not be stored at all.
How do we charge the card again without it?
Stored-credential billing: the CVV proves possession at the first charge; merchant-initiated charges against a vaulted credential run without it.
Is keeping the last four digits and expiry okay?
Yes — last four is a permitted truncated form and expiry isn't sensitive authentication data. That pair is what your team needs to recognize a card, and it's exactly what a vault shows them.
Our phones record calls — is a recorded CVV a problem?
Yes, recordings are storage. Pause recording during card entry — or stop taking cards by phone and send a secure capture link instead.
Delete the column. Keep the billing.
Card Vault captures cards directly from your customer, charges them on your schedule without a CVV in sight, and shows your team last-four-and-expiry — the part they're allowed to see. Free for your first five cards.