What CVV fraud looks like

Card verification value fraud is any attempt to complete a card-not-present transaction with a valid CVV that the person typing it did not lawfully obtain. The strongest early signal is a pattern that does not match the cardholder: several small authorizations within minutes, a run of declined codes, and shipping details that change between orders. Fraudsters test stolen numbers in batches, so failed attempts often show up before a successful charge.

cvv fraud red flags

Cardholder warning signs

Check statements and account alerts for these markers.

CVV Fraud Clues

• Charges from merchants you do not recognize, especially digital goods, gift cards, or prepaid top-ups.
• Declined transactions you never made, which can indicate someone testing your number.
• Text or email asking for your CVV, full card number, or a one-time code. Legitimate issuers do not ask for the CVV.
• A change of address on file or a replacement card mailed without your request.

Merchant and issuer warning signs

• CVV verification failures across several different cards from one IP address or device fingerprint.
• A billing address and shipping address in different countries, paired with expedited shipping.
• Multiple orders on different cards shipping to a single address.
• Email addresses that are newly created or use disposable domains.
• Order totals that sit just under a fraud review threshold.

Steps to take when you spot the signs

1. Freeze the card in your issuer's mobile app or call the number printed on the back of the card.
2. Write down each suspicious charge with the date, amount, and merchant name.
3. File a dispute with the card issuer for every unauthorized transaction.
4. Change the password on the affected account and turn on multi-factor authentication.
5. Request a new card number and a new CVV instead of reactivating the compromised card.
6. Place a fraud alert or a security freeze with the credit bureaus if your identity data may be exposed.
7. Report the incident to the FTC and to local police when losses are significant.

How to lower your exposure

Use tokenized wallets and virtual card numbers at online checkout so the merchant never stores your real CVV. Keep CVV values out of saved notes, chat apps, and email drafts. On the merchant side, never store the CVV after authorization, and route any order with mismatched billing data to manual review. Train support staff to verify through the issuer rather than asking a customer to read a code out loud.

cvv fraud signs