What CVV fraud is
The card verification value is a 3 or 4 digit code printed on the card. Visa, Mastercard and Discover place 3 digits on the back, near the signature strip. American Express places 4 digits on the front, above the account number. The code ties a transaction to the physical card. A thief who pulls a card number from a database breach does not get the CVV, because PCI DSS bars merchants from storing it after authorization.
Fraud happens when the code leaks by another path. Known routes include skimmers on fuel pumps and ATMs, phishing pages that ask for the code, call center agents who write it down, and malware on a terminal that captures keystrokes before encryption.
Card testing
Stolen numbers plus CVVs get tested in batches. The attacker runs small charges, often under $5, across many merchants. An approval means the card works. A decline moves that number to a discard list. Signals in order data: many low-value orders from one IP range inside a short window, several card numbers tried in sequence, billing and shipping countries that do not match, and email domains registered days before the order.
Controls for merchants
- Require the CVV on every card-not-present order. Do not store it after authorization.
- Run AVS checks on street number and ZIP. Treat a mismatch as a review flag, not an automatic decline.
- Set velocity limits per card, per IP address, and per device fingerprint.
- Use EMV 3-D Secure on high-risk orders. Liability shifts to the issuer when authentication succeeds.
- Tokenize card data at the point of entry so the account number never reaches your database.
- Watch decline rates. A jump in declines from one source points to testing.
Controls for cardholders
- Cover the code when you hand over a card in a store.
- Do not read the code to anyone who calls you. Banks do not ask for it by phone.
- Check statements each week and report unknown charges the same day.
- Freeze the card in the bank app when it is not in use.
Where the controls fail
A CVV check stops a bare card number from working. It does not stop a full data set taken from a compromised checkout page that captured the code before tokenization. Issuers outside the US and Canada do not support AVS for most cards, so address checks return no result on cross-border orders. Chargebacks still arrive after an approved sale, so approval is not proof of a genuine buyer.