Card-not-present fraud leaves traces in the authorization request. A CVV fraud signal is any field or pattern that departs from what the issuer and the merchant expect for that card. One signal alone proves nothing. Fraud teams collect signals, weight them, and act on the total score.

cvv fraud warning signs

What the CVV check does

CVV2 (called CVC2 by Mastercard and CID by American Express) is a 3-digit code printed on the back of most cards, or 4 digits on the front of American Express cards. The code is not stored on the magnetic stripe or the chip. A merchant that collects CVV2 sends it in the authorization message. The issuer compares it to its record and returns one of three results: match, no match, or not processed.

cvv fraud signals

PCI DSS Requirement 3.2 bars storage of the CVV2 after authorization. A merchant that keeps the code is out of compliance.

more on this topic

Signals inside the authorization response

• CVV no match.
• AVS mismatch on street address, ZIP, or both.
• CVV match with full AVS mismatch. The two checks use different data sets, so agreement between them carries weight.
• Decline code 05 (do not honor) or 14 (invalid card number) at a rate above the merchant's normal.
• Repeated declines on one card, then an approval for a smaller amount.

Signals outside the authorization message

• IP country does not match the card's BIN country.
• IP resolves to a VPN, proxy, or hosting provider range.
• Device fingerprint seen with many different card numbers.
• Email address registered days or hours before the order.
• Billing address and shipping address in different countries, or a shipping address tied to a reshipper.
• Order value far above the card's past ticket size at that merchant.
• Many small authorizations from one IP or one device in a short window.
• Cardholder name typed differently from the name on the card.
• Digital goods with instant delivery, where no physical address check exists.

Card testing

Card testing is a run of low-value authorizations used to sort live card numbers from dead ones. Signs include a burst of authorizations in minutes, card numbers that run in sequence, a single checkout page, amounts near $1, and a decline rate above 80 percent. A merchant that sees this pattern is a testing target, not a sales channel.

more on this topic

What the signals cannot show

CVV mismatch can come from a typo, a card reissued after a compromise, or a household member using a shared card. AVS mismatch can come from a move. A VPN can come from a privacy tool. Signals need weights and thresholds. Rules alone generate false declines, and false declines cost more revenue than fraud for many merchants.

Data sources fraud teams use

• Issuer authorization response: CVV result, AVS result, decline code.
• Device fingerprint and IP reputation feeds.
• Velocity counters per card, IP, device, email, and address.
• BIN and IIN tables for issuer and country lookup.
• Network and consortium fraud data shared between merchants and issuers.
• Chargeback records tied to the same device or address.

Metrics to track

Track fraud rate in basis points, dispute ratio, and false decline rate. Visa and Mastercard run dispute monitoring programs with ratio and count thresholds. The thresholds change, so check the current program guides. A merchant near a threshold faces fines and a compliance plan.

Steps for a merchant

1. Send CVV2 and AVS data on every card-not-present order.
2. Log the full authorization response, including the CVV and AVS result codes.
3. Score signals together instead of blocking on one field.
4. Apply step-up authentication, such as 3-D Secure, when the score crosses a set threshold. A completed 3-D Secure check shifts chargeback liability to the issuer.
5. Report fraud attempts to the FBI Internet Crime Complaint Center and to the acquiring bank.

Legal note

Buying, selling, or using card numbers that belong to another person is a crime in the United States under 18 U.S.C. 1029. Merchants and analysts work with their own transaction data, not with purchased card records.