What a CVV test does

A CVV test confirms that your payment stack reads, sends, and acts on the card verification value during authorization. In a sandbox, you submit a test card number that is programmed to return a specific CVV result and check that your system produces the matching decline. In production, the same signal feeds fraud rules: a spike of CVV mismatches from one IP range or device fingerprint is a card-testing attack, not routine customer error.

read more

Never test with a live card number. Processors publish sandbox PANs that cannot move money and exist only for this purpose.

The Ultimate Buying Guide for Fraud Detection Using CVV Tests

Prerequisites

  • A sandbox account with your payment processor
  • The processor's published test card table
  • Access to raw authorization responses and decline codes
  • Write access to your decline-handling and logging logic

How to run a CVV test

  1. Open the sandbox environment of your payment processor.
  2. Select a test card that the processor documents as failing CVV verification.
  3. Enter the test card number with a valid future expiry and any three-digit value in the CVV field.
  4. Submit the authorization request.
  5. Read the response code and confirm it maps to a CVV mismatch, not a generic decline.
  6. Repeat the submission with a test card documented as passing CVV verification.
  7. Confirm the passing case reaches authorization and the failing case stops before capture.
  8. Record both outcomes in your test suite with the exact response strings.
  9. Automate both cases so they run on every build.

Test values worth knowing

Stripe documents 4000 0000 0000 0002 as a card that fails the CVV check and 4000 0000 0000 0127 as one that returns an incorrect CVC response. Other processors publish comparable tables. Use the table from your own provider, because decline codes differ between acquirers and card brands.

cvv test for identifying fraud

Reading the result correctly

A CVV failure and a stolen-card decline are separate events. If your system collapses every failure into one vague message, your fraud rules cannot tell a typo from an attack. Map each response code to a distinct internal reason, then decide whether to retry, block, or step up authentication.

Fraud Screening CVV Test: A Comprehensive Guide

Using CVV signals against card testing

  • Count CVV mismatches per BIN, IP, and device over short windows.
  • Flag bursts of small authorizations spread across many cards in minutes.
  • Watch for sequential or recycled card numbers hitting the same endpoint.
  • Throttle the endpoint rather than blocking a single card.

Compliance limits

PCI DSS forbids storing the CVV after authorization, in any form, including logs and error messages. Your test plan must prove that the value is transmitted, checked, and then discarded. Audit your application logs to confirm the field never lands in a database or a debug trace.