Dynamic CVV
A dynamic CVV is a card security code that changes at set intervals, in place of the fixed three or four digit code printed on a traditional card. It is shown in a banking app or on a small screen built into the card. Because each code expires quickly, a stolen card number paired with an old code cannot be used for online purchases.
Last updated: November 2026
How does a dynamic CVV work?
The card issuer generates a new security code on a schedule and shows the current one to the cardholder, either in its app or on a small display on the card. When the cardholder pays online, they enter the code that is valid at that moment. The issuer checks it during authorization and rejects any code that has expired.
Static CVV vs. dynamic CVV
- Static CVV: printed on the card and the same for the life of the card. If it is copied along with the card number, it can be reused.
- Dynamic CVV: changes regularly. A copied code stops working once the next one is issued.
CVV, CVC, and CID
These are different names for the same kind of code. Visa calls it CVV, Mastercard calls it CVC, and American Express calls it CID and usually prints four digits on the front of the card. All of them exist to show that the person paying has the full card details and not only the card number.
Does a dynamic CVV work with subscriptions?
Usually, yes. Card security rules do not allow merchants to keep the security code after a payment is authorized, so later charges on a saved card are normally processed without it. A changing code only gets in the way when a merchant asks for the code again, in which case the current one is needed. See card on file.
Dynamic CVV vs. virtual cards
Both limit what a thief can do with stolen details. A dynamic CVV changes one part of the card. A single-use virtual card or a dedicated virtual card changes the whole card number, and can also be limited to one merchant or one amount through card controls.
How Opal approaches card security for ad spend
Opal gives agencies and brands unlimited free virtual cards, so each ad platform or client has its own card number and spending limit. If one card's details are exposed, that card can be replaced without touching the others. See how Opal works for agencies.
Frequently asked questions
For online payments, yes. A static code can be reused if it is stolen with the card number. A dynamic code stops working when it is replaced, so stolen details lose their value quickly.
In the card issuer's mobile app or, on some cards, on a small screen on the card itself. The printed position where a fixed code would normally be is either blank or shows the changing code.
It depends on the issuer. Codes are replaced on a schedule the issuer sets, or each time a new one is requested in the app. The issuer's app or the card's display always shows the code that is currently valid.
See what Opal can do for you
Learn how our spend platform can increase the strategic impact of your finance team and future-proof your company
