The core advice
No legitimate business ever needs to buy, sell, or store a card verification value. If you sell online, the purchase decision that actually matters is your fraud stack. Choose tools that validate CVV with the issuer at the moment of authorization, pair that check with address verification and risk-based authentication, and keep only a pass or fail result on your side. Anything that asks you to hold the three or four digit code after the authorization response is a liability with no upside.
The same rule protects shoppers. A CVV is a live security credential. Any person or site that offers to trade card data is offering stolen property, and using it is a crime in every U.S. jurisdiction.
What to look for in a CVV fraud prevention setup
- Authorization-time CVV validation. The check should ride on the authorization request, not on a separate lookup. You want the issuer response code returned to your system so you can act on it.
- Address Verification Service. CVV alone is weak. Pair a CVV mismatch with an AVS mismatch to get a usable signal.
- 3-D Secure or risk-based step-up. Challenge the transaction when the risk score crosses your threshold, and skip the challenge for low-risk repeat buyers.
- Velocity and device signals. Count attempts per card, per email, per device, and per IP over rolling windows.
- Tokenization. The card number and the security code should never touch your servers. Let the payment provider hold them.
- Decline code visibility. You cannot tune rules you cannot see. Confirm the provider exposes raw issuer response codes.
- Chargeback reporting. Fraud rules that cut chargebacks by a point but kill conversion are not working.
Parameter bands that hold up in practice
- CVV mismatch: decline outright for digital goods, gift cards, and first-time buyers. Step up to authentication for established customers with a clean history.
- Risk score review band: route the 60 to 80 range to manual review. Above 80, decline. Below 60, let it flow.
- Card testing velocity: block after three to five declined authorization attempts on one card or one device within 24 hours.
- Manual review rate: keep it between 1 and 3 percent of orders. Higher means your rules are too tight.
- False positive target: under 5 percent of flagged orders confirmed as legitimate after review.
Pitfalls to avoid
- Storing the security code in a helpdesk ticket, a CRM note, or an order comment. PCI DSS forbids retaining sensitive authentication data after authorization.
- Asking a customer to read the code back over chat, email, or phone. Agents should never collect it.
- Treating a CVV mismatch as a soft signal on high-margin digital orders. That is the exact segment card testers target.
- Relying on one rule. Fraudsters probe for the single control you forgot.
- Ignoring small authorization bursts. Card testing often shows up as clusters of low-value attempts.
- Confusing the printed code with the chip-generated value. They are different data elements with different rules.
FAQ
Is it legal to buy or sell CVV data?
No. Card security codes belong to the cardholder and the issuing bank. Trading them is trafficking in stolen access devices and carries criminal exposure under federal law.
Can my business store the security code?
Not after authorization. PCI DSS treats it as sensitive authentication data, and it must not be retained even in encrypted form.
CVV Fraud Prevention V6 Guide: How to Protect Your Transactions
What is card testing?
An attacker runs small authorizations against many card numbers to find live ones. Blocking repeated failed attempts by device and IP is the main defense.
Does 3-D Secure remove fraud risk?
It shifts liability for covered transactions and raises the cost of attacks. It does not replace velocity rules, AVS, or manual review.
What should a shopper do if a code was exposed?
Contact the card issuer, request a replacement card, and review recent transactions for small unfamiliar charges.