Card words in plain English: Ilia Zavialov on what CVV, 3-D Secure and a hold actually mean

The four things printed on a card, and who reads them

A payment card carries a small set of data, and each item has one job. The long number identifies the bank that issued the card and the account behind it. The expiry date sets the window in which that number is valid. The short code on the reverse belongs to a separate category, and it does separate work.

Behind every payment stand three parties with three vocabularies. Your bank, the issuer, answers yes or no. The card scheme routes the message between them. The shop's bank, the acquirer, collects the money and supplies the wording that later turns up on your statement. Statements read oddly because that wording comes from a stranger.

Reading in the right order helps. Look at the card face first, then at the checkout screen, then at the line in the app the next morning. Each surface uses a different word for the same event, and the mismatch sends people to the telephone in a panic. Knowing what CVV, 3-D Secure and a hold actually mean removes most of that panic before it starts.

CVV: three printed digits with one narrow job

The code on the reverse of a card goes under several names. The schemes call it CVV, CVC or CID, and banking apps often call it the security code. It is printed flat on the card, it is absent from the chip and the magnetic stripe, and a compliant shop is forbidden from keeping it after the sale. That combination defines what the code can prove.

Its narrow job is to show that the plastic was in someone's hand when an online order was placed. A leaked database of card numbers and expiry dates carries no CVV, and neither does a photograph of the front. Whoever holds those fragments still lacks three characters that exist only on the card.

That is why the code is the most requested item in any telephone script. Nobody inside a bank needs it, because the issuer generated it. The United States Federal Trade Commission recorded a billion dollars lost to business impersonation in 2025, and the heaviest losses fell on people contacted by someone claiming to work at their own bank.

A reader who has understood what CVV, 3-D Secure and a hold actually mean hears such a request differently. However plausible the caller sounds, the question worth asking is why a bank would ask for a value it already holds.

3-D Secure: the step that decides who carries the loss

3-D Secure is a short exchange between a shop and your bank while you wait at checkout. The three domains in the name are the shop's bank, the card scheme and your bank. Each scheme markets the step under its own brand name, and today it usually appears as a push notification in your banking app, a biometric check, or a one-time code.

The step does two things at once. It authenticates the person paying, and it moves liability for a later dispute towards the issuer once the check is complete. That second effect explains why shops are keen to run it, and why the pressure to finish feels heavier than its security value justifies.

Many payments now pass through what the industry calls a frictionless flow, where the risk data suffices and no prompt appears. The absence of a prompt tells you nothing about the absence of a check. The opposite case carries real information: a prompt arriving when you are buying nothing means somebody holds your card details and is testing them.

In the United Kingdom, purchase scams accounted for 71 per cent of all authorized push payment cases during 2025, with 118.1 million pounds lost and a rise of 20 per cent on the year, according to UK Finance. Across authorized push payment cases as a whole, 66 per cent begin online. An imitation of an authentication screen is cheap to build and sits where a buyer expects one.

Authorisation and hold: money that has moved and money that has not

When you pay, the shop puts a question to your bank and gets an answer within seconds. That answer is the authorisation. It trims your available balance and reserves the amount for the shop. Nothing has left the account at this stage, and the ledger balance often stays where it was.

The reserved amount is the hold. It stays in place until the shop finalises the sale and submits it for clearing, normally later the same day or across the following days. Some trades reserve an estimate instead: petrol pumps, hotels and car hire desks hold a figure with little relation to the final one. The surplus is released when the true amount arrives.

A hold can also expire by itself. If the shop never completes the sale, the reservation drops away after a period set by the scheme and the issuer, and no entry reaches the statement. What you watched was a number in the available balance field doing its job.

Knowing what CVV, 3-D Secure and a hold actually mean pays off precisely here. A pending line and a posted line describe two states of one event. Only the second is a debit against your account.

The unfamiliar name on the statement

The text printed beside an amount is the descriptor, supplied by the shop through its acquirer. It commonly carries a registered company name, and few buyers recognize it from the shopfront. A city and a country code usually follow, and both belong to the payment business.

So a coffee bar can appear under a holding company, and a small seller can appear under a marketplace. A purchase made on your own high street can be billed from abroad. The city is the registered address of whoever processed the money, and it changes when the shop changes provider.

Before treating a strange line as fraud, match it on three points: the date, the exact amount and the card charged. Then check standing subscriptions and any card saved inside an app, because those charge on their own timetable under names chosen months earlier. Most unrecognised lines are settled at this stage.

MCC: four digits that describe a shop's trade

Every merchant is handed a merchant category code by its acquirer, a four-digit number saying what the business sells. It seldom appears in a consumer statement. Yet it governs which purchases earn cashback, which fall under a spending block, which count as a cash advance, and what fee the shop pays.

The code attaches to the merchant as a whole. A bookshop inside a department store may be classified as the department store, and a ticket bought through an agency may be coded as travel. Rewards and blocks both follow the code, which is why one identical purchase behaves differently in two shops on the same street.

For a reader the code is a diagnostic tool. If a payment was refused at a shop your bank had no obvious reason to refuse, or a purchase attracted a charge you did not expect, the category code is usually the explanation. Only the merchant and its acquirer can change it, though an adviser can tell you which code was used.

Where the border runs, and how these words are used against people

The border is simple to state. A held amount is a promise your bank has made to a shop. A posted amount is money that has already gone. The rest of the vocabulary hangs off that distinction, and most anxious calls to a bank turn out to be a hold read as a debit.

Fraud built on delivery messages exploits the same border on purpose. The Federal Trade Commission reports that a delayed parcel is the commonest theme in scam text messages, and during 2025 a customs charge joined it. Many people said they had paid a small redelivery fee, and the small size was the point: the form existed to collect their card details.

The same commission notes that in four impersonation reports out of five no money was lost at all. Attempts outnumber successes by a wide margin, and the difference is usually one moment of recognition. Knowing what CVV, 3-D Secure and a hold actually mean supplies that moment more reliably than general advice about staying alert.

One practical closing note. If a page or a caller wants the code from the back of your card, or wants you to approve a request in your banking app that you never started, the correct move is to stop and open the app yourself. Every term on this page can be checked there in a minute, and the check costs nothing.