Testing CVV attacks means running automated attempts to find out whether stolen card numbers and CVV codes will authorize, typically through small purchases or card verification fields at checkout. It is a form of carding fraud, and buying, selling, or testing CVVs is illegal in the US and most other countries. Merchants spot it through authorization velocity, decline patterns, and device or location anomalies, then block it with rate limits, mandatory CVV checks, and 3-D Secure.

CVV Attack Script Guide: How to Avoid and Protect Yourself

How does a CVV attack work?

An attacker loads a list of card numbers and CVV values into a script or bot and pushes them through a payment form. The goal is to separate live cards from dead ones by reading the authorization response.

read more

Fraudsters often target low-value items, donation pages, or free trial signups because those flows attract less scrutiny. Successful hits are then resold or used for larger purchases.

CVV Attack Tool: What It Is and Why Buying CVV Data Fails

What signals indicate card testing?

Card testing produces a recognizable pattern in authorization data, even when each individual attempt looks ordinary.

cvv attack test

• A spike in declined authorizations from many different card numbers on one checkout.
• Many small transactions in a short window, especially repeated amounts.
• High diversity of card issuers or bank identification numbers from one device or IP range.
• Mismatch between billing address, shipping address, IP location, and card country.
• Automated form fill speed, missing mouse movement, or repeated failed CVV entries.

How do merchants stop CVV testing?

Layered controls work better than any single check, because attackers adjust when one defense blocks them.

1. Require CVV at authorization and reject mismatches without revealing which field failed.
2. Apply velocity limits per IP, device, email, and card BIN.
3. Turn on 3-D Secure for high-risk or new-customer transactions.
4. Use address verification and block when billing data conflicts with the issuer record.
5. Rate limit the payment endpoint and add bot detection at checkout.
6. Monitor decline ratios and alert when a single source produces repeated declines.

Is storing a CVV allowed?

No. PCI DSS treats the CVV as sensitive authentication data that must not be stored after authorization, even in encrypted form. Retaining it expands breach exposure and violates card network rules.

Merchants that need repeat billing should use network tokenization or stored credentials from the issuer or processor instead of keeping the CVV.

What are the legal consequences of buying or testing CVVs?

Buying, selling, or testing card credentials is a federal crime in the US under access device fraud and wire fraud statutes. Penalties can include prison time, fines, and restitution, and card networks can bar the merchant account involved.

Consumers should report stolen card data to the card issuer and to the FTC, and businesses should report intrusions to the FBI.

Why does card testing matter to a business?

Each attempt can trigger chargebacks, network fines, and higher processing costs, even when the transaction is declined. Sustained testing can also damage a merchant's approval rate and reputation with acquirers.