Short answer

A CVV fraud clue is any mismatch between the card verification value a buyer submits and the value the issuer has on file, or any pattern around that mismatch. The common ones are a decline code tied to CVV, a billing address that fails verification, three declines on one card followed by an approval, and a shipping address far from the billing address. No single clue proves fraud. Analysts score several together.

CVV Fraud Symptoms: How to Spot Card Security Code Misuse

What the CVV check does

The card verification value is a 3-digit code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The issuer generates the value from the card number and a key. The merchant sends the code in an authorization request. The issuer answers with a match, no match, or not processed.

CVV Fraud Patterns: What Card-Not-Present Fraud Looks Like

PCI DSS requirement 3.2 bans storage of the CVV after authorization. That rule exists because the code is the one piece of card data a thief cannot pull from a magnetic stripe or a chip read. Storage makes it pullable.

cvv fraud markers

Clues at checkout

• CVV result of no match while the card number still authorizes.
• Address verification returns a partial match on the street number and a full miss on the ZIP code.
• Several declines in a row on one card number, then an approval for a small amount.
• One device submitting card numbers in sequence from the same bank identification number range.
• Browser language, IP country, and billing country do not line up.

Clues in order data

Card testing shows up as bursts. A single IP address may run 20 or 30 low-value authorizations in an hour. The orders tend to use free email domains, guest checkout, and next-day shipping. The shipping address changes between attempts while the card stays the same. Or the card changes while the address stays the same.

cvv fraud symptoms

High-resale goods draw more attempts. Gift cards, electronics, and luxury apparel are targets because the goods convert to cash fast.

Clues on the consumer side

Cardholders see the other end. A charge of 1 dollar or less that the holder does not recognize is often a test. Larger charges follow if the thief keeps the card. Unfamiliar merchant names, charges in a state the holder has never visited, and a run of small approvals are the usual reports. The FTC tells cardholders to dispute the charge with the issuer and file a report at IdentityTheft.gov.

FBI Internet Crime Complaint Center data list credit card fraud among the top complaint categories it receives each year.

What CVV checks do not catch

A working CVV does not prove the buyer is the cardholder. Full card data from a breach or a skimmer includes the CVV. Fraud rings also use phone calls and email to get the code from the cardholder. The check raises the cost of an attack. It does not close it.

Merchants who score CVV, address verification, device fingerprint, velocity, and shipping history together catch more than merchants who rely on one field.