Stripe decline code: incorrect_cvc

The card security code did not match what the issuer holds. Stripe lists both `incorrect_cvc` and `invalid_cvc` as decline codes with identical descriptions, and as an error code `incorrect_cvc` reads "The card's security code is incorrect. Check the card's security code or use a different card." A CVC failure is recoverable in a way most declines are not, because the customer is holding the card and can simply read it again.

• The customer mistyped the security code.
• The wrong code read off the card — American Express prints a four-digit code on the front, while Visa, Mastercard and others use three digits on the back.
• A stored card being charged with a CVC that was captured at some earlier point and is no longer valid to send.
• The customer entering a code from a different card.

1. Ask the customer to re-enter the security code, which is Stripe's documented step. This is one of the few declines where a retry in the moment genuinely works.
2. Check your form accepts four digits for American Express. A field hard-capped at three makes every Amex payment fail this way.
3. Do not store CVCs and do not resubmit them on subsequent charges — the card networks prohibit storage, and a stale value fails here.
4. Label the field with where the code is printed. Front for Amex, back for most others.

• Stripe card_declinedcard_declined
• Stripe expired_cardexpired_card
• ISO 8583 05Do not honour

• Card test toolkit

Why does every American Express payment fail with incorrect_cvc?

Almost certainly a form that only accepts three digits. American Express uses a four-digit code printed on the front of the card; a maxlength of three silently truncates it, and the truncated value never matches.