A fraud screening CVV test is a check a merchant runs during card authorization to confirm the 3- or 4-digit verification code on a payment card matches the code the issuer has on file. The issuer returns a one-letter response code, such as M for match or N for no match, and the merchant's rules use that result to approve, review, or decline the order. A card number alone does not pass this check, so the test raises the cost of card-not-present fraud.
What Happens During a CVV Test?
The customer enters the card number, expiration date, and verification code at checkout. The payment gateway sends the code inside the authorization request to the card network, which forwards it to the issuing bank. The issuer compares the submitted code with its records and returns a response code in the authorization reply.
- Visa: CVV2, a 3-digit code on the back of the card.
- Mastercard: CVC2, a 3-digit code on the back.
- American Express: CID, a 4-digit code on the front.
- Discover: CID, a 3-digit code on the back.
The printed code is separate from the data on the magnetic stripe or chip. Merchants cannot store the printed code after authorization under PCI DSS, so each new transaction needs a fresh test.
CVV Response Codes and What They Mean
Issuers reply with a single character. The meaning is set by the card networks and applies across processors.
- M (Match): the code matches. This is the only result that confirms the code was correct.
- N (No match): the code is wrong. This is a strong fraud signal in card-not-present orders.
- P (Not processed): the issuer did not run the check. Common when the code was not sent or the issuer does not support the service.
- U (Unknown): the issuer cannot verify, often because it is not certified for CVV checks.
- S (Should have been present): the code was missing but the issuer expected one.
- X (No response): no result returned, often a network or timeout issue.
Codes P, U, S, and X do not prove fraud. They show that no usable check happened, so risk teams treat them as neutral or as a reason for extra review.
How Fraud Teams Use CVV Results in Screening Rules
CVV results work best as one input in a rule set. A mismatch paired with an address mismatch is a common decline trigger. A match paired with high order velocity may still go to manual review.
- Decline: CVV no match plus AVS no match, or a no match on a high-value order.
- Review: CVV match but the device, email, or IP looks new or risky.
- Approve: CVV match plus AVS match plus a low-risk history, with 3D Secure for regulated markets.
Card testing and CVV checks
Fraudsters test stolen card numbers with small purchases or donation pages to see which ones work. A CVV test blocks numbers that lack the printed code, which many card dumps do not include. Velocity limits, device fingerprinting, and 3D Secure add friction.
CVV vs AVS vs 3D Secure
These three checks answer different questions. They complement each other rather than replace each other.
- CVV: Does the buyer have the card in hand? Verifies the printed code.
- AVS: Does the billing address match the issuer's records? Useful for card-not-present orders.
- 3D Secure: Does the issuer authenticate the cardholder with a password, app, or biometric? Shifts liability in some regions.
What Are the Limits of CVV Screening?
- PCI DSS forbids storing the code after authorization, so it cannot be reused for recurring billing or subscriptions.
- Some issuers do not take part, which produces U or P results and weakens the signal.
- Phishing pages and data breaches can expose the code, so a match does not prove the buyer is the cardholder.
- CVV is not strong customer authentication under PSD2 in Europe.
- MOTO and some cross-border channels may not pass the code at all.
Does a CVV Match Mean the Order Is Safe?
No. A match only shows that the code entered matches the issuer's record. A fraudster with full card data from a breach, or a phished code, can pass a CVV test. Risk teams pair the result with device data, shipping checks, order history, and 3D Secure before they treat an order as low risk.
Why Buying CVVs Is Illegal and Fails Screening
CVV codes are not a product banks or issuers sell. Sites that offer CVVs for sale trade in stolen payment data. Using them to place orders is carding, a crime under US wire fraud and identity theft laws and similar laws in most countries. Merchants and issuers flag those transactions, report them, and block the accounts involved. A CVV test is one of the checks that catches this activity.
Frequently Asked Questions
What does a CVV test tell a merchant?
It tells the merchant whether the printed verification code matches the issuer's record at the moment of authorization. The result is one letter, from M for match to N for no match, along with neutral codes when no check happened.
Can a CVV test stop all fraud?
No. It blocks orders that lack the printed code, but it does not verify the identity of the buyer. Full card data from a breach can pass a CVV test, so the check works as part of a wider fraud screening stack.
Do merchants store CVV after a transaction?
No. PCI DSS prohibits storing the code after authorization. Merchants and processors must delete it, which is why subscriptions and recurring payments do not use CVV tests after the first charge.
What is a normal CVV mismatch rate?
Mismatch rates vary by market, channel, and issuer. A small share of legitimate customers mistype the code or use a card that does not print one, so risk teams use thresholds rather than declining every no-match.