A CVV test assessment page is a web page or script that claims to check whether a card verification value is valid. Real payment systems do not work that way. Merchants submit the CVV to the card network during authorization and never receive the code back, so no legitimate business has any reason to publish a public CVV testing tool. Pages that promise to validate CVVs are phishing traps, scams, or instruments used to sort stolen card data, and using them is a crime in the United States.
What does a CVV actually do?
The CVV is the 3-digit code on the back of most cards, or the 4-digit code on the front of American Express cards. It exists to prove that the physical card is in hand during a card-not-present transaction. Issuers derive it from the card number, the expiration date, and a secret key, so it cannot be guessed or calculated by outsiders.
How do legitimate merchants verify a CVV?
The merchant's payment processor sends the CVV with the authorization request and receives only a result code, such as match, no match, or not processed. The code itself is never returned to the merchant. PCI DSS rules prohibit storing the CVV after authorization, which is why no honest processor can build a page that tests one.
Reputable merchants add other layers, including address verification and 3-D Secure. Those steps confirm the cardholder through their own bank and shift fraud liability away from the seller.
Why do CVV test pages exist?
They exist to monetize stolen data. Someone holding a batch of card numbers needs a fast way to learn which ones still work, so they rely on checkers, bots, or so-called assessment pages that fire small authorization attempts. Others are pure phishing: the page collects the card number, expiration date, and CVV you type in, then resells the full record.
Is it legal to buy or test a CVV?
No. In the US, buying, selling, or possessing stolen card credentials violates federal law, including 18 U.S.C. Section 1029, which covers trafficking in access devices. Using a card that is not yours, even for a one-dollar test charge, is unauthorized use and can be prosecuted as fraud. Penalties include prison time and substantial fines.
How do I spot a CVV assessment scam?
- Payment is demanded in cryptocurrency or gift cards, which cannot be reversed.
- The offer promises a valid rate or refunds when cards fail testing.
- Sample CVV records are shown to prove legitimacy, which itself signals stolen data.
- The page asks for the CVV of your own card as a verification step.
What should I do if I find one?
Report it to the FBI's Internet Crime Complaint Center or the Federal Trade Commission. If you entered your own card details on such a page, call your issuer immediately, freeze the card, and dispute any charges that appear.
Frequently asked questions
Can a CVV be checked without charging the card?
Not in any legitimate way. Issuers return a CVV result only as part of an authorization, so every test attempt is a real and traceable charge attempt tied to a merchant account.
Are CVV generators real?
No. The code is derived with a secret key held by the issuer, so no public algorithm or calculator can produce a working CVV.
Do merchants see the CVV after a sale?
No. They see a pass or fail result during authorization, and nothing more. Storing the code afterward is a violation of card industry security standards.