A CVV test is an authorization check that a payment processor runs against the three- or four-digit card verification value to confirm the cardholder has the card in hand at checkout. It confirms the digits match what the issuer has on file. It does not tell anyone whether a card number is live, funded, or safe to use.
CVV Test Accessibility v9: A Comprehensive Guide
That second point matters, because "CVV testing" is also the name people give to running stolen numbers through a checkout to find ones that work. That activity is card testing fraud, and it is the pattern most fraud engines are built to catch.
What a CVV test checks, and what it leaves out
The CVV is a short code printed on the card: three digits on the back of Visa, Mastercard, and Discover cards, four digits on the front of American Express. The issuer generates it from the card data, and the merchant sends it with the authorization request.
- What it confirms: the person entering the order has the card, or a copy of it.
- What it does not confirm: that the card is active, has funds, or belongs to the person typing.
- What it never does: prove a card number is real outside a live authorization.
Issuers can approve an authorization and still flag a CVV mismatch, or approve with a mismatch when the merchant's risk settings allow it. Those outcomes are set by the issuer and the merchant's rules, not by the cardholder.
Where the CVV sits in an authorization request
A card payment sends several fields to the issuer at once. The CVV is one of them, and it carries less weight than people assume.
- Card number and expiry date
- CVV or CVC code
- Address verification (AVS) data, such as ZIP and street number
- 3-D Secure cryptogram, when the merchant uses it
If the CVV field is wrong, the issuer returns a specific decline code. If the number itself is dead, the decline looks different. A merchant sees the code; a stranger with a list of numbers does not.
Why a CVV check cannot validate a card number
There is no public lookup that says whether a card number is real. The card networks do not publish one, and no merchant tool can return that answer. A number can pass a format check (the Luhn algorithm) and still be total junk.
Merchants who run test authorizations to "check" cards often break card scheme rules and can lose their processing account. People who do it with numbers they do not own are committing payment fraud.
How card testing attacks look from the merchant side
Card testing is a volume game. Someone with a list of stolen numbers runs small orders through a checkout, sometimes a cent or a dollar, and keeps the numbers that get approved.
- A burst of orders from one IP range or one device fingerprint.
- Decline rates that jump from a few percent to double digits in a day.
- Many orders for the cheapest item in the catalog, often digital goods.
- Dozens of card attempts on one customer account, or many accounts on one card.
Attackers rotate proxies and card numbers, so the pattern shows up in aggregate numbers before it shows up in any single order.
What card testing costs a merchant
Each failed attempt can carry an authorization fee, and each approved fraudulent order brings a chargeback later. Chargeback ratios above the card networks' thresholds trigger monitoring programs and per-transaction fines.
Worse, a merchant hit by repeated card testing can land on a terminated merchant file, which makes it hard to open a new processing account. That risk is why checkout teams treat card testing as an emergency, not a nuisance.
How to harden a checkout against card testing
- Require CVV and AVS checks on every card-not-present order, and decline on mismatch.
- Set velocity limits per IP, device, email, and card BIN.
- Add a challenge step that appears when risk signals spike.
- Block disposable email domains and known proxy ranges at the payment step.
- Use 3-D Secure for high-risk orders, so the issuer authenticates the cardholder.
- Watch decline rates daily and set an alert for a sudden rise.
- Never store the CVV. PCI DSS forbids keeping it after authorization.
What cardholders should know about CVV requests
No legitimate business asks you to "test" a card, verify a CVV over the phone, or send a photo of your card. A caller who says they need the code to "confirm" a refund is running a scam.
Give the CVV only inside a checkout page you reached by typing the merchant's address. If a site asks for it in chat, email, or a text message, close the tab.
FAQ
Is it legal to test card numbers?
Running card numbers you do not own through a payment page is fraud in the US and most other countries. Testing your own card with a merchant's help, for a refund or a subscription update, is a normal transaction.
Can a CVV check tell me if a card is valid?
No. A CVV check is one field in an authorization request. The issuer decides the outcome, and a pass does not mean the card has funds or that the transaction will settle.
Why do some sites ask for the CVV a second time?
Some processors re-run verification for stored cards, or a subscription update triggers a new authorization. A site asking again inside its own checkout is normal. A stranger asking by message is not.
Does a CVV stop all fraud?
No. It stops someone who has the card number but not the card. It does not stop a thief who has the card in hand, and it does not replace address verification, 3-D Secure, or velocity rules.