Short answer

A CVV enumeration test is a scripted run of card numbers against a live checkout page, trying CVV values until one authorization goes through. It is card testing fraud, it is a federal crime in the United States, and it is the main reason cards sold on "where to buy CVV" sites stop working within hours. The second a card gets tested, the issuer, the processor, and the merchant all have a record of it.

related article

What the test actually measures

Every authorization request comes back with a response code. Approved. Do not honor. CVV mismatch. Insufficient funds. Pickup card. A fraud ring runs thousands of these in a short window and sorts the responses into buckets: live, dead, and worth retrying. That sorting is the entire product. It is also the thing that gets noticed.

cvv attack test

From the merchant side, the pattern is hard to miss once you know what you are looking at. A wall of small-dollar attempts from one IP range or one device fingerprint. Decline rates jumping from 8 percent to 70 percent in an afternoon. Card numbers that share a Bank Identification Number prefix, hitting the same checkout form in sequence. Fraud teams call it a BIN attack. Visa and Mastercard both publish guidance on it, and processors will shut a merchant account down if the merchant ignores it.

more on this topic

Why tested cards are already spoiled

This is the part buyers do not think through. The value of a card in a resale listing depends on nobody having touched it. Once a checker has run it, three things happen at once:

read more

• The issuer logs an authorization attempt from an unusual geography or device.
• Velocity rules on that BIN start flagging the whole range, not just the one number.
• The seller keeps a copy of whatever authorized, because the checker output is the seller's inventory list.

So the buyer who pays for a "fresh" card is often paying for something that was tested, logged, and resold. The seller's incentive runs the other direction too. If a card has $2,000 on it, the person holding it has no reason to sell it for $15.

The marketplace reality

Search traffic for CVV listings is high, and the supply side is dominated by three things: outright scams that take crypto and deliver nothing, sites that harvest the buyer's own identity and device data, and law enforcement operations that run storefronts for months before indictments land. Payment is almost always non-reversible, which means there is no chargeback, no support line, and no recourse.

Legal exposure is not theoretical. 18 U.S.C. § 1029 covers trafficking in access devices, and penalties scale with volume. A first offense involving ten or more devices carries up to 10 years; larger operations and repeat offenses go higher. Prosecutors do not need to prove you used a card, only that you trafficked in account numbers. Chat logs, wallet records, and the enumeration traffic itself all serve as evidence.

Checking for enumeration on your own site

If you run a store, this is the practical part. Watch authorization volume per IP and per device fingerprint. Set a floor on order value. Require 3D Secure step-up after a failed CVV attempt from the same session. Block disposable email domains at checkout. Send decline-rate spikes to your fraud queue instead of letting them ride. Stripe, Adyen, and Braintree all document these controls, and most of them are a config change, not a development project.

And if the reason you searched for this term was that you wanted to test a card you own, the sandbox in your own gateway does that for free with published test numbers. Penetration testers do the same thing inside a signed scope. Neither of those is enumeration, and neither of them puts you in front of a grand jury.

Where to report it

Merchants who see a testing wave should file with the FBI's Internet Crime Complaint Center and notify their acquirer the same day. Cardholders who spot unfamiliar authorizations should call the number on the back of the card first, then follow up in writing. Speed matters more than paperwork here, because the accounts that get locked early are the ones that do not get drained.