The short answer

Card testing is a fraud pattern where someone runs a batch of stolen card numbers through a checkout form to find out which ones still authorize. The CVV check is one of the gates they watch. A number that clears the CVV and address verification checks is worth more on the black market than one that fails, so the attacker's goal is not the product they pretend to buy. It is a yes or no answer from your gateway.

cvv fraud test attack

You do not stop this with one setting. You stop it with a few overlapping controls plus someone watching the decline data.

cvv brute force test

Why the charges are small

Testers keep the amount low, often a dollar or less, because they are paying with a card that is not theirs and they want to avoid tripping a threshold that triggers a manual review. Sometimes they do not even complete an order. A failed authorization still tells them what they need to know. That detail matters for merchants, because it means the damage often shows up in your authorization logs before it shows up in your order queue.

cvv fraud test attack

Signals worth watching

• A cluster of low-value attempts in a short window, especially from the same IP or device fingerprint.
• Card numbers arriving in sequence, or many different BINs hitting one product page.
• Decline rates that jump while order volume stays flat.
• Billing addresses that do not match where the traffic is coming from.
• Many attempts across many accounts, each used once.

I look at the ratio of attempts to completed orders first. Normal shoppers abandon carts, but they do not usually abandon twelve of them in ten minutes from one connection.

CVV Enumeration Test: A Guide to Where to Buy CVV

Controls that catch most of it

Velocity limits are the first layer. Cap the number of authorization attempts allowed per IP, per device, and per card fingerprint in an hour. Set a floor on order value or require extra verification below it. Turn on CVV and AVS rules so a mismatch declines instead of routing to review. Add 3-D Secure for higher-risk transactions, since the extra authentication step breaks most automated scripts. A challenge on the payment page, whether that is a CAPTCHA or a lightweight bot check, raises the cost of running thousands of attempts.

After a wave hits

Expect chargebacks to lag the attack by weeks, so keep the authorization records. Pull the IP and device data for the window, block what you can, and dispute the transactions with the evidence your processor asks for. If you use a fraud scoring service, feed the confirmed cases back into it. One bad night of testing can produce a month of disputes, and the paperwork is easier when the logs are still there.