mercadopago invalid_security_code: cvv not collected on the saved card

TL;DR

Mercado Pago requires the security code for many card payments, including charges against saved cards: if your flow skips CVV collection on a stored card, the payment fails with invalidsecuritycode. Add a CVV field to the saved-card payment step, include the code in the payment request, and retry. Check Mercado Pago's security code requirements for the card's issuer, since some issuers mandate it.

mercadopago invalid_security_code: cvv not collected on the saved card

Use this when

• Mercado Pago returns invalidsecuritycode on a saved-card payment
• Your one-click checkout skips CVV entry
• First-time card payments work but saved-card payments fail

Not for this skill when

• The shopper entered a wrong CVV on a new card (they should just re-enter it)
• The issuer declines for a different reason
• You are tokenizing the card rather than charging it

Steps

1. Confirm the failing payment used a saved card without a CVV in the request. Expected: You verify the CVV was missing.

2. Add a security code input to the saved-card checkout step. Expected: Shoppers can supply the CVV for stored cards.

3. Include the collected code in the payment creation request. Expected: The request carries the security code.

4. Retry the payment. Expected: invalidsecuritycode is resolved.

5. Review your issuer matrix: some issuers always require CVV, so make collection the default for saved cards. Expected: No saved-card flow can skip the code silently.

Tool compatibility

Mercado Pago payments API; security code requirements vary by issuer and are enforced server-side.

Variant phrasings

mercadopago saved card cvv required

The requirement stated as a rule.

mercadopago invalid security code stored card

Ties the error to the saved-card flow.

collect cvv for saved card mercadopago

The fix as an action phrase.

Why it happens

Saved cards remove friction, but issuers still want proof of cardholder presence for many transactions, and the CVV is that proof. Mercado Pago enforces the security code requirement per issuer rules: when the code is absent on a payment that requires it, the gateway rejects the request before contacting the issuer. One-click flows that cache everything except the CVV hit this wall. Collecting the code at payment time satisfies the requirement without storing it.

Edge cases / pitfalls

• Never store the CVV: collect it, use it once, and discard it, per PCI rules.
• Some issuers waive CVV for low-risk recurring charges; do not assume the requirement is universal.
• If the shopper's saved card was tokenized without CVV support, you may need to re-collect card details once.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_j9OtHcCNtDKD3S-x1wNCbg

Resolved from the public thread: https://vectle.com/posts/pst_j9OtHcCNtDKD3S-x1wNCbg

Thread query: mercadopago invalidsecuritycode: cvv not collected on the saved card

TL;DR: Mercado Pago requires the security code for many card payments, including charges against saved cards: if your flow skips CVV collection on a stored card, the payment fails with invalidsecuritycode. Add a CVV field to the saved-card payment step, include the code in the payment request, and retry. Check Mercado Pago's security code requirements for the card's issuer, since some issuers mandate it.