Typed Card Numbers Drop 22% When the CVC Field Comes First
A checkout form that asks for the three-digit code before the sixteen-digit card number cuts complete card entries by roughly 22%, according to conversion data shared by three U.S.-facing processors that tested the layout change between January and March. The finding runs against a decade of form-design convention, in which the card number sits at the top of the payment block and the CVC field waits at the bottom. It also lands awkwardly for the regulated U.S. iGaming operators now spending heavily on deposit-page optimization, because the same field order that appears to reduce typed card numbers also appears to reduce completed deposits.
The numbers come from A/B tests rather than a single vendor's marketing deck. One processor serving sportsbook clients ran the reordered form to 1.4 million checkout sessions over six weeks and recorded a 22.4% decline in events where a valid card number was entered, measured against a control group on the conventional layout; the drop was concentrated among first-time depositors, where it reached 27%. A second processor, working with two casino brands, reported a 19.8% decline across 600,000 sessions. A third declined to share raw figures but confirmed a decline "in the low twenties" and said it had stopped recommending the layout to clients. None of the three would speak on the record, citing client confidentiality, and the figures have not been independently audited. Treat the 22% as a directional signal from commercial testing, not a peer-reviewed result.
The mechanism is not mysterious to people who build payment pages. Asking for the CVC first forces a user to locate the physical card before they have committed to typing anything, and a meaningful share of users who reach that point either do not have the card in hand or decide the friction is not worth it. The card number field, by contrast, is the point of no return: once someone starts typing, abandonment falls sharply. Moving the CVC ahead of it moves the decision point earlier, and earlier decision points favor the back button.
Why the layout worked, and why it stopped
The CVC-first order was not an accident of design fashion. It spread through U.S. payment stacks around 2019 for a specific reason: it reduced chargebacks. Fraudsters working from stolen card data often have the number but not the code, and a form that demands the code first filters them out before they invest effort in a full entry. Processors that adopted the layout reported measurable declines in authorization attempts on compromised cards, and the change was cheap to implement.
The tradeoff was invisible for years because most operators measured deposit conversion at the account level, not the field level. A user who bailed at the CVC field and returned an hour later with their wallet registered as a conversion, not an abandonment. When the first processors began instrumenting field-level drop-off in late 2024, the cost of the fraud filter became visible: a large share of legitimate users were being screened out alongside the fraudulent ones.
"We were optimizing for a fraud metric and calling it a UX decision," said a payments lead at a mid-sized U.S. sportsbook who asked not to be named because his employer has not authorized public comment. "The CVC-first form was doing exactly what it was designed to do. It was also costing us deposits we never saw in a report, because those users never became users."
That framing matters for how the 22% should be read. The decline is not a decline in demand. It is a decline in completed entries, and the two are only loosely related. Some of the missing 22% are fraud attempts that the layout correctly stopped. Some are users who came back later on a different device. The processors' tests cannot separate those groups cleanly, and none of the three would estimate what share of the drop represented genuine lost revenue versus filtered abuse.
The mobile effect
The decline was not evenly distributed. On mobile, where the reordered form produced a 24.6% drop in the first processor's test, the effect was larger than on desktop, at 18.1%. The gap is consistent with the friction story: mobile users are more likely to be interrupted mid-entry, more likely to be on a slow connection, and less likely to have a physical card within reach when a form asks for it. The same processor found that users on iOS abandoned at the CVC field at nearly twice the rate of Android users, a split it could not fully explain and flagged as an open question.
What it costs an operator to find out
For a U.S. operator, the relevant question is not whether the 22% is real but whether the fraud savings it buys outweigh the deposits it costs. That is a calculation most operators are not set up to run, because fraud losses and conversion losses sit in different departments and different reporting cycles.
A rough version of the math: a mid-sized sportsbook taking 40,000 first deposits a month at an average of $180 would see roughly 8,800 fewer completed entries under the reordered layout if the 22% figure held. If half of those were fraudulent attempts that would have been declined anyway, the operator loses about 4,400 legitimate deposits, or roughly $790,000 in monthly handle at the point of entry. Against that, the processor's own data showed chargeback rates falling from 0.41% to 0.29% on the reordered form, a saving that on the same volume comes to well under $100,000 a month. The gap is wide enough that the layout should have been abandoned years ago, which raises the question of why it was not.
The answer is partly institutional. The CVC-first form was baked into payment SDKs and hosted checkout pages that operators did not control, and changing it meant a development cycle most payments teams could not justify without a conversion number to point at. The tests that produced that number only became possible once processors added field-level analytics, which most did between mid-2024 and early 2025.
The regulatory wrinkle
There is a compliance dimension that complicates any quick reversal. Several state gaming regulators require operators to collect and verify the CVC as part of know-your-customer and anti-fraud procedures, and while none of the rules reviewed for this article specify field order, compliance teams have historically treated the CVC-first layout as a defensible control. An operator that moves the field to the bottom of the form is not violating a rule, but it is changing a control that a regulator may later ask about. Two compliance officers at U.S. operators said their teams would want documented evidence that the reordering did not increase fraud before signing off, which means the processors' unaudited figures are unlikely to be enough on their own.
There is also the matter of card network rules. Visa and Mastercard both require the CVC to be collected for card-not-present transactions where the issuer supports it, but neither mandates where on the form it appears. The reordering is therefore permissible, provided the code is still collected and transmitted. The risk is reputational and regulatory rather than contractual.
What the tests did not measure
The three tests share a limitation that undercuts any simple conclusion: none of them tracked what happened to the users who abandoned at the CVC field. Did they return? Did they deposit through another method, such as an e-wallet or a bank transfer? Did they open an account at a competitor? Without that data, the 22% is a measure of form behavior, not of revenue.
A fourth processor, which ran a smaller test in February, found something that suggests the picture is more complicated. In its sample of 90,000 sessions, the reordered form reduced card entries by 21% but increased e-wallet deposits by 14%, leaving total deposit conversion down only 6%. If that pattern holds at scale, the layout change may be less about losing customers than about pushing them toward payment methods that carry lower fraud risk and, in some cases, higher processing fees. That is a different business problem, and a more tractable one.
"The interesting number is not the 22%," said a risk analyst at a U.S. casino operator who reviewed the processor data. "It's what happens to the people who leave. If they come back through a wallet, you have not lost a customer. You have changed how they pay. Nobody has measured that yet, and until somebody does, we are arguing about the wrong metric."
The industry's measurement habits are part of the story. Deposit conversion is typically reported as a single ratio, which hides the field-level behavior that determines it. Operators that have added funnel analytics in the past year are discovering that their most important conversion lever may be a form field they did not know they controlled. Those that have not are still making layout decisions on vendor defaults and intuition.
Where the number goes from here
The 22% figure is already circulating in payments circles, and at least two U.S. operators are running their own tests this quarter. The results will matter beyond checkout design. If the decline holds and the fraud cost stays flat, the CVC-first layout will look like a decade-long mistake preserved by institutional inertia. If the fraud cost rises enough to offset the conversion gain, the layout will look like a reasonable trade that was simply never measured.
The more consequential question is what the episode says about how iGaming operators evaluate the tools they inherit. The CVC-first form arrived as a fraud control, performed that job, and stayed long past the point where anyone checked whether it was still worth the cost. That is a familiar pattern in an industry that has grown quickly on vendor defaults, and it is not limited to payment forms. The same could be asked of bonus terms, verification flows, and the placement of responsible-gambling prompts, all of which are typically set once and rarely tested against a control group.
For now, the practical advice from the processors is narrow: instrument the field level, run the test on your own traffic, and do not assume that a layout inherited from a payment SDK is neutral. The 22% may not replicate exactly at any single operator. But the fact that three separate tests found a decline in the same direction, on the same layout, across different client bases, is enough to suggest the conventional form order deserves a second look. Whether operators take that look, or wait for a regulator or a competitor to force the issue, is the open question the data cannot answer.