CVV fraud is the use of a stolen card verification value to push a card-not-present order through approval. Prevention rests on four controls: collect the code on every order, never store it, verify the billing address, and send risky orders to issuer authentication with 3-D Secure. Add velocity limits and a manual review queue for orders that fail those checks.
Why the code carries weight
The three digit code on the back of a Visa or Mastercard, or the four digit code on the front of an American Express, is printed on the card and not encoded on the magnetic stripe. Card data lifted from a skimmer or a database breach holds the account number and the expiration date. It does not hold the code when merchants follow the storage rules.
PCI DSS classifies the CVV2 as sensitive authentication data. Requirement 3.3.1 of PCI DSS v4.0 bars storage of that data after authorization, with or without encryption.
Controls that reduce CVV fraud
1. Require the code on every transaction
Make the CVV a required field at checkout. A missing code is a hard stop, not a warning. Some issuers do not support code checks on certain card products, so route those orders to another check instead of approving them on the card number alone.
2. Never store the code
Do not log the CVV in order notes, call center screens, or payment gateway responses. Mask it in any support tool that touches a live order. Keep the code out of scope by tokenizing the card at the gateway.
3. Check the billing address and ZIP
Address Verification System responses compare the numeric parts of the billing street address and ZIP code with issuer records. A full match lowers risk. A mismatch on the street number or ZIP is a reason to hold the order. AVS works on US and Canadian addresses. It returns limited data on most international cards.
4. Send orders to 3-D Secure
EMV 3-D Secure adds an issuer step to the authorization. The issuer scores the device, the browser, and the account history, then approves, challenges, or declines. A liability shift applies to approved transactions on eligible card programs. The cost is friction. Apply the step to new customers, high ticket carts, and orders that fail AVS.
5. Set velocity limits
Count attempts per card, per email, per IP address, and per device within a fixed window. Card testing runs show up as many small orders in minutes, several cards on one account, and repeated declines on one card number.
Signals of a card testing attack
- Several orders in a short window with values under $5
- Multiple card numbers tried on one account or one IP address
- Billing and shipping addresses that differ on a first order
- Email domains that are days old
- Decline rates above 30 percent on one card
When a check fails
- Hold the order. Do not ship.
- Request a second factor: a cardholder call to the number on file with the issuer, or a signed authorization form.
- Log the outcome against the account and the device.
- Refund the order if the buyer does not respond within the stated window.
Limits of a CVV check
A matching code shows that the buyer holds the physical card or has read it. It does not prove the buyer is the account holder. A family member, a coworker, or a thief with a photographed card can pass the check. Stack the code check with AVS, 3-D Secure, and velocity rules. No single control covers the gap.