CVV attack detection is the practice of finding automated card-testing traffic in your payment logs before it turns into chargebacks. It rests on three data points a card tester cannot hide: authorization velocity, clusters of identical decline codes, and mismatches between the card's BIN country, the buyer's IP address, and the billing address. A merchant that reads those signals in the first few minutes limits the damage to a handful of authorization fees.
What does a CVV attack look like in your payment data?
Card testing is a script that pushes stolen card numbers through a live checkout to learn which ones still authorize. The attacker keeps the order value low and the request count high, because the goal is information, not merchandise. Your logs show the pattern even when each single request looks normal.
Velocity and timing
Human buyers move at human speed. Test traffic fires dozens of attempts inside a minute, often from one IP or a small set of IPs in the same subnet. Sessions last seconds, the cart value repeats, and the same email or phone number shows up against many different card numbers.
Decline code clusters
Every test returns a result the attacker wants: approved, declined, or a specific error. Watch for bursts of the same response code landing in tight sequence, such as "do not honor," "invalid CVV," or "insufficient funds." A wall of identical declines in a short window is the clearest single sign of a script.
BIN, IP and address mismatches
Stolen card data travels. A card issued in Brazil, used from a data center IP in the Netherlands, with a US billing address, is a mismatch worth a flag. One mismatch means little. Twenty in an hour means someone is testing.
Which detection signals matter most?
- Authorization attempts per IP, per card BIN, and per email over 1, 5, and 60 minute windows.
- Share of declines in a window, plus the single most common decline code.
- Average order value below your normal floor for that product line.
- Distance between IP location and card BIN country.
- One device fingerprint or session cookie reused across many card numbers.
- Count of distinct cards tried on one account or one shipping address.
- Time from page load to payment submit, since bots submit fast.
How do you build a rule set that works?
- Pull 90 days of authorization logs and label the known test bursts.
- Set a baseline per market, since order values and decline rates differ by country.
- Start with hard blocks on the extreme tail: five attempts from one IP in ten minutes, for example.
- Add soft rules behind the hard ones: CAPTCHA, 3-D Secure step-up, or manual review.
- Log every rule hit with a reason code so you can explain blocks to your acquirer and to real customers.
- Review hits and false positives on a fixed schedule, then retire rules that no longer fire.
What should you do once a burst is detected?
- Block the source at the edge: IP, ASN, or device ID, for 24 hours to start.
- Force 3-D Secure on the affected BIN ranges or order values.
- Void authorizations that have not shipped yet.
- Send your acquirer the timestamps and the rule that fired.
- Close confirmed test orders instead of shipping them.
Which tools run these checks?
Three layers cover most of the work. Your payment processor's fraud rules handle velocity and decline logic at the authorization step. A WAF or bot management service filters the traffic before it reaches checkout. A chargeback monitoring feed tells you when a burst slipped through.
Fraud vendors add cross-merchant data, which helps when the attacker uses fresh IPs on each pass. They do not replace your own rules, because only you know your normal order values and customer behavior.
How do you keep false declines low?
False declines cost sales, so rules need a ceiling. Cap hard blocks at the extreme tail and route everything else to a challenge instead of a block. Track the approval rate for flagged customers in the weeks after you deploy a rule; a drop there means the rule is too broad.
Frequently asked questions
What is the difference between a CVV attack and a normal decline?
A normal decline is one card failing for one reason. A CVV attack is many cards failing, or many cards mixed with a few approvals, in a short window from a shared source. Volume plus repetition separates the two.
Can a small merchant detect card testing without a fraud vendor?
Yes. Processor logs plus a spreadsheet with 15-minute buckets show the pattern. Rules on velocity and decline share catch most scripts; vendors add speed and shared data, not the basic logic.
How long does a card-testing burst last?
Most bursts run from a few minutes to a couple of hours. The same botnet may return days later from a new IP range, so the answer is a standing rule set, not a one-time cleanup.
Does 3-D Secure stop CVV attacks?
It raises the cost. A challenge blocks most automated attempts because the script cannot complete authentication. Attackers move to merchants that skip it, so coverage across your checkout matters more than any single rule.
Do CVV attacks always come with high decline rates?
No. A skilled tester mixes in valid cards to keep the ratio looking human. Watch the count of distinct cards per source, not just the decline share.