CVC/CVV verification is enabled

CVC verification is a card-not-present fraud control: the three- or four-digit code proves the cardholder has physical access to the card, since CVC is never stored by merchants after authorization and is not present on card magnetic stripes. Disabling CVC verification — whether by removing the CVC field from the checkout form or by configuring Stripe Radar to allow cvc_check != 'pass' — removes this signal entirely. The practical result is that stolen card numbers without physical card access become viable for fraudulent purchases. PCI-DSS 4.0 Req 8.3 covers authentication factors for payment flows; CWE-287 (Improper Authentication) captures the failure mode when a required authentication element is bypassed.

CVC verification is on by default for all major providers and requires no code to enable. The action needed is to verify it has not been disabled.

For Stripe Elements, <CardElement /> includes the CVC field automatically — do not configure it out:

// CORRECT — default CardElement includes CVC
<CardElement />

// WRONG — do not remove the CVC field via custom options
<CardElement options={{ disableLink: true, hidePostalCode: true }}
  // Even hidePostalCode is fine — but never disable the cvc field itself
/>

In the Stripe Dashboard under Radar rules, check that no rule reads cvc_check != 'pass' in an Allow if condition. If you find one, delete it. For legitimate recurring charges on saved payment methods (where CVC is unavailable by PCI rules), document the exemption and confirm the initial card enrollment collected CVC.