What Is a Cardholder Verification Method (CVM)?

When you tap, insert or swipe a card, the terminal has two questions. Is the card genuine? Is the person holding it the cardholder? The cardholder verification method answers the second one.

What is a cardholder verification method?

Visa defines it as "A means of verifying that the person presenting a Card is the legitimate Cardholder." It adds: "For a Chip Card, the hierarchy of preferences for verifying a Cardholder's identity is encoded within the Chip."1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 Card issuers set that order, terminal makers and acquirers implement it, and merchants see it as a PIN prompt, a signature line, or nothing at all.

CVM is a card-present idea. Online, there is no terminal: the issuer authenticates the cardholder through 3D Secure instead.

Types of CVM

Adyen is direct about signatures: "You are responsible for verifying the signature."2Adyen Docs, Cardholder verification methods (read October 14, 2026) Its terminal reports the method actually used in a CVM result field, from "Online PIN" to "No CVM performed".2Adyen Docs, Cardholder verification methods (read October 14, 2026)

How the CVM list works in an EMV chip

The CVM list sits on the chip (EMV tag 8E). It holds two amounts, X and Y, and a series of 2-byte rules. Byte one says which method to use and what to do if it fails: stop, or move to the next rule. Byte two sets a condition, such as "always", "if the terminal supports it", "cash back", or "under / over amount X".3EFTlab, Cardholder Verification in EMV (read October 14, 2026)

Visa makes this binding on both sides. Issuers must communicate CVM preferences "by the Chip Cardholder Verification Method list" (section 4.1.17.13). Every acceptance device must "Act upon Card preferences for Cardholder Verification" (section 5.6.1.1, Table 5-8).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 For contactless, a reader's "Reader CVM Required Limit" must be set to the applicable Cardholder Verification Limit (same table). Above it, Adyen says online PIN is required, so the payment cannot be completed offline.2Adyen Docs, Cardholder verification methods (read October 14, 2026) See offline transaction.

Inside Tagada

See every payment's route, processor by processor

Set the order your processors are tried in, per store, per country or per product.

See how routing works

CDCVM: verification on the phone

Visa defines CDCVM as "An Issuer-approved, Visa-recognized method for verifying a Cardholder using the Cardholder's payment device," for example mobile devices or cards with a fingerprint sensor.1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 EMVCo lists "passcodes, passwords and patterns, as well as biometrics such as fingerprint, iris, voice and facial recognition."4EMVCo, CDCVM: Promoting Security, Reliability and Convenience, October 1, 2020

• Apple Pay: "A payment can be made only after the Secure Element receives authorization from the Secure Enclave," after Face ID, Touch ID, the passcode, or a double-click on an unlocked Apple Watch. The cryptogram can include "User verification results, such as Cardholder Verification Method (CVM) information."5Apple Platform Security, Payment authorization with Apple Pay (read October 14, 2026)
• Google Wallet: you need a screen lock, and "If prompted, use your Android screen lock to verify the payment."6Google Wallet Help, Pay with your phone in stores (read October 14, 2026) If you verified in the past few minutes, "you may not be required to verify for another transaction."7Google Wallet Help, Verify it's you to make a purchase (read October 14, 2026)

Visa sets rules for issuers too. Every mobile payment device must support CDCVM (section 4.1.17.24). An issuer must not pre-set a CDCVM that "is the same as, or otherwise represents, the PIN" of the physical card (section 4.1.17.25).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 A biometric wallet can also satisfy strong customer authentication.

No CVM at the POS: the contactless limits

Small taps skip verification through the Visa Easy Payment Service (VEPS), "A service that permits qualified Merchants to process Transactions in a Card-Present Environment without requiring Cardholder Verification."1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 A VEPS payment must be card-present, authorized, under the country maximum, and must not be cash back, quasi-cash or a fuel dispenser payment (section 5.8.12.1). Some maximums from section 5.8.12.2:1Visa Core Rules and Visa Product and Service Rules, April 18, 2026

Visa's public table covers the AP, Canada, CEMEA, Europe and LAC regions; the US is not listed. In the EEA, PSD2 adds its own cumulative cap on contactless payments without SCA, explained on our strong customer authentication page.

Who requires PIN, and who pays for fraud

Some countries make PIN the issuer's preferred CVM. In India, Visa issuers must decline a domestic card-present debit or reloadable prepaid authorization that "does not include a PIN or the confirmation that PIN was correctly entered" (section 4.1.9.1). Canadian chip cards must carry offline PIN, online PIN at ATM, signature and no CVM, with offline PIN preferred (section 4.1.17.14).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 Australia and New Zealand rules are covered on our smart terminal page.

The method also decides who loses money on a fraud. Under Visa dispute condition 10.2, the issuer can charge back a card-present fraud on a PIN-Preferring Chip Card if the terminal was not chip-reading or "not EMV PIN-compliant." The dispute is invalid for a contactless or VEPS transaction, or one "correctly processed at an EMV PIN-Compliant Acceptance Device" (section 11.7.3).1Visa Core Rules and Visa Product and Service Rules, April 18, 2026 Adyen warns that with PIN bypass, "The liability for related chargebacks may shift from the issuer to you."2Adyen Docs, Cardholder verification methods (read October 14, 2026) More on the liability shift and chip and PIN.

For how issuers check the cardholder on online payments, see our guide to payment authentication.