# Even if the CVV of the credit card is wrong, a token can be generated, is this correct behavior?

**URL:** <https://developer.squareup.com/forums/t/even-if-the-cvv-of-the-credit-card-is-wrong-a-token-can-be-generated-is-this-correct-behavior/8133>\
**Category:** Questions\
**Tags:** sandbox\
**Created:** [January 5, 2023, 10:41am UTC](https://developer.squareup.com/forums/t/even-if-the-cvv-of-the-credit-card-is-wrong-a-token-can-be-generated-is-this-correct-behavior/8133 "2023-01-05T10:41:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![koutaku](https://avatars.discourse-cdn.com/v4/letter/k/bbce88/32.png) [@koutaku](https://developer.squareup.com/forums/u/koutaku)\
**Post date:** [January 5, 2023, 10:41am UTC](https://developer.squareup.com/forums/t/even-if-the-cvv-of-the-credit-card-is-wrong-a-token-can-be-generated-is-this-correct-behavior/8133/1 "2023-01-05T10:41:20Z")

</div>

Even if the CVV of the credit card is wrong, a token can be generated, is this correct behavior?

The test numbers listed on this page are used.

> **[Sandbox Payments](https://developer.squareup.com/docs/devtools/sandbox/payments)**
>
> A quick reference of test credit card numbers and payment tokens you can use to make test payments with the Square Sandbox.

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [January 5, 2023, 5:13pm UTC](https://developer.squareup.com/forums/t/even-if-the-cvv-of-the-credit-card-is-wrong-a-token-can-be-generated-is-this-correct-behavior/8133/2 "2023-01-05T17:13:23Z")

</div>

Yes, that is correct. The tokenization of a card isn’t a full validation. It’s a light format validation of the information. Only when the token is used to make a payment will it be validated with the information the bank has. 🙂

---

<div class="post-metadata">

**Author:** ![DeanPP](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@DeanPP](https://developer.squareup.com/forums/u/DeanPP)\
**Post date:** [December 17, 2023, 9:59pm UTC](https://developer.squareup.com/forums/t/even-if-the-cvv-of-the-credit-card-is-wrong-a-token-can-be-generated-is-this-correct-behavior/8133/3 "2023-12-17T21:59:58Z")

</div>

Just for clarity and for anyone reading this in the future, our experience with this error has nothing to do with payments. We are simply:

1. Capturing card token via the embedded Square web form (later used as the source ID in step 3);
2. Creating a Square customer; and then
3. Adding the newly tokenised card to the Square customer record for future use.

It’s the last step where we are seeing this ambiguous error message.