CVV testing is the practice of submitting a card security code with a payment request to confirm that the card number and the code belong together and that the account is active. Merchants run this check at checkout as routine CVV verification. Criminals run the same check at scale, using automated card testing attacks to sort stolen card data into working and dead numbers.
What does CVV verification actually check?
A CVV is a short code printed on the card but not stored in the magnetic stripe or chip data, so possession of a card number alone does not reveal it. The merchant passes the code to the issuer during authorization, and the issuer compares it against its own records.
The response comes back as a match, a mismatch, or unavailable. A match raises the odds the person holds the physical card, but it does not prove the cardholder authorized the charge.
Why do fraudsters test card numbers?
Card testing lets an attacker validate thousands of stolen numbers before reselling them or cashing them out. Attackers prefer small dollar amounts, digital goods, and instant delivery because those patterns rarely trigger manual review.
Each successful test charge becomes a chargeback when the real cardholder disputes it. Merchants absorb the refund, the dispute fee, and the risk of losing card processing privileges.
How does a card testing attack look in transaction data?
- Many different card numbers submitted from one IP address or device in a short window.
- Repeated low-value orders, often in the same dollar range.
- Card numbers that share sequential bank identification numbers.
- Billing details that do not match the cardholder address or that change between attempts.
- A sharp rise in declined authorizations and CVV mismatches.
How do merchants stop card testing attacks?
Require the CVV and the billing address on every transaction, and turn on 3-D Secure for high-risk orders. Add velocity limits, device fingerprinting, and a challenge such as a CAPTCHA on checkout forms.
Block disposable email domains and free proxy traffic, and flag orders that fail the same check repeatedly. Review decline patterns weekly so an attack is caught in hours instead of weeks.
Is CVV testing illegal?
Testing card numbers that belong to someone else is illegal in the United States and most other jurisdictions. It falls under access device fraud, wire fraud, and identity theft statutes, and convictions can carry prison time and restitution.
Buying, selling, or trading card data is a separate crime on its own, even if no charge is ever completed.
Why can't a business store CVV values?
PCI DSS prohibits storing sensitive authentication data, including the CVV, after authorization is complete. Keeping that data expands the breach exposure and creates a direct compliance failure at audit.
Store only a token from your payment processor, and route every new charge through a fresh authorization.