CVV examination is the practice of reading the card verification value response your processor returns during authorization and using that result, together with other fraud signals, to approve, challenge, or decline a card-not-present order. A CVV match alone does not prove the buyer is legitimate, and a mismatch does not always mean fraud. The value comes from pairing the response code with address verification, velocity data, and order context.

read more

Prerequisites

  • Access to raw authorization response data from your gateway or processor.
  • A rule engine or fraud tool that can act on response codes.
  • A written policy for handling mismatches, including review and refund paths.

How to Examine CVV Results

  1. Confirm that your systems never store the CVV or CVV2 value after the authorization completes. Keep only the verification result.
  2. Pull the CVV response code for each transaction from your gateway logs or settlement file.
  3. Translate the code into its plain meaning: match, no match, not processed, unavailable, should have been present, or not supported by the issuer.
  4. Pair the CVV result with the AVS result for the same transaction.
  5. Assign each pair a risk weight based on your own historical chargeback data.
  6. Send transactions that return a mismatch or an unavailable code to a step-up authentication flow such as 3-D Secure.
  7. Route orders above your value threshold, or from customers with two or more prior mismatches, to manual review.
  8. Record the decision, the code, and the reviewer outcome in a case log.
  9. Review the rule weights each month and adjust them when chargeback rates shift.

What the Response Codes Tell You

  • Match: the issuer confirmed the code. Treat this as one positive signal, not as proof.
  • No match: the code was wrong. This is a strong fraud signal in card-not-present channels.
  • Not processed: the issuer or network did not check the code. The transaction carries no CVV signal.
  • Unavailable: the issuer could not verify at that moment. Consider a retry or a step-up challenge.
  • Not supported: the card type or issuer does not participate. Rely on other controls.

Common Mistakes

  • Declining every mismatch outright instead of routing the order through review.
  • Treating a match as a guarantee and skipping velocity or device checks.
  • Logging the CVV value itself, which breaks PCI DSS rules and creates breach exposure.
  • Setting thresholds once and never revisiting them.

Metrics to Watch

  • Mismatch rate by card brand and by channel.
  • Chargeback rate for approved mismatch orders.
  • Step-up completion rate and abandonment rate.
  • Manual review turnaround time.