On my website, payments are done using a PCI-compliant 3rd partner. If the client agrees, I store a TOKEN of the card (returned by the PCI partner).

I want to make a new payment with CVV for the stored token.

Can I display on my website the 4 last digits of the credit card and a field for the client to enter the CVV? On submit, I send a payment request to the PCI partner with the token and the entered CVV. Of course I don't save the CVV.

Is this process offending PCI requirements?

If yes, does it mean I have to redirect my client to my PCI partner website in order to enter the CVV only in a PCI-compliant server?

1 Answer 1


Assumptions: 3rd party partner is an approved Payment Processor, "Standard Website" means a site using HTTPS/TLS1.2, and all other PCI requirements are followed (e.g., data in transit encryption, server security, etc.).

Storing the token and sending it to the payment processor for reoccurring payments is a best practice. This meets the requirements for PCI 3.5.1 - "PAN is rendered unreadable anywhere it is stored."

The payment processor may not require the CVV to be sent. I'd make sure it's necessary before you go through the implementation.


PCI Tokenization Product Security Guidelines
What is Tokenization and How Can I Use it for PCI DSS Compliance

  • Your assumptions are correct. My Standard Website already works for payments that do NOT require CVV (the terminal /bank account used doesn't require CVV). Newly I have the need to make payements REQUIRING CVV (the terminal /bank account requires CVV). Nov 8, 2023 at 15:44
  • @EmmanuelGleizer, it sounds like you align with PCI requirements, then. I think your approach of showing the last four digits and requesting the CVV is sound.
    – kenlukas
    Nov 8, 2023 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .