What a CVV attack is

A CVV attack is a card-testing run against a payment form. The attacker holds a list of stolen card numbers and CVVs and needs to know which ones still authorize. Small charges, often under $1, get submitted until a card returns an approval. Approved cards move on to resale or to larger fraud.

The CVV is the 3-digit code on the back of Visa, Mastercard, and Discover cards. American Express prints 4 digits on the front. The code proves the person holding the card number also holds the physical card.

Signals of a card-testing run

• Many distinct card numbers from one IP address or device fingerprint in a short window.
• Order totals of $0.00 to $1.00, or totals that repeat across cards.
• Sequential or clustered BINs (the first 6 to 8 digits).
• High decline rates, then a burst of approvals.
• Disposable email domains and mismatched billing addresses.
• Failed CVV checks from the same session, retried with new card data.

Checkout defenses that work

1. Require the CVV field on every card-not-present authorization and decline on mismatch. Do not store the value.
2. Turn on address verification (AVS) and set rules for partial matches.
3. Deploy EMV 3-D Secure. The protocol passes risk data to the issuer, and issuers can challenge or approve without friction.
4. Set velocity caps: N attempts per IP, per device, per BIN, per email domain, per hour.
5. Block or challenge known hosting and proxy ranges at the edge.
6. Use CAPTCHA at the payment step, in addition to account creation.

Monitoring

Track authorization rate, CVV mismatch rate, and average ticket size by hour. A card-testing run shows as a fall in average ticket size and a rise in attempt count before chargebacks arrive. Card networks run chargeback monitoring programs. Visa's VDMP and Mastercard's equivalent set thresholds and fees. Fraud appears in chargebacks 30 to 90 days after the test charges.

What you cannot store

PCI DSS prohibits retention of the CVV after authorization. Version 4.0, Requirement 3.3.1 covers sensitive authentication data. Any system that logs the CVV, including debug logs, spreadsheets, and customer-service notes, is out of scope. Attackers target those stores because a breach of one gives them a clean list.

If you are a cardholder

Small unrecognized charges, often $1 or less, precede larger fraud. Freeze the card through the issuer app, then dispute. A reissued card with a new number and new CVV stops the pattern.