Answer first

CVV fraud is any unauthorized card-not-present charge that uses the three or four digit verification code printed on a card. The code is not held on the magnetic stripe, so a thief who has a card number and expiration date still needs the CVV from a breach, a skimmer, a phishing page, or a photo of the card. Symptoms surface in two places: the cardholder statement and the merchant order log.

cvv fraud signals

Symptoms on a cardholder statement

1. Small test charges between $0.50 and $5, often from unfamiliar merchants.
2. Several charges on the same day at stores you have never used.
3. Recurring billings you did not set up, appearing monthly.
4. Charges in a currency or country you have no connection to.
5. Transactions that post even after the physical card stayed in your wallet.
6. A sudden drop in available credit with no matching purchase.
7. Delivery or order confirmation emails for items you did not buy.
8. Security codes or one-time passcodes you did not request.

Symptoms inside merchant and processor data

• Orders with mismatched billing address, shipping address, and IP location.
• Multiple card numbers tried from one device or IP in a short window.
• A high rate of decline and retry on the same order session.
• Free email domains paired with high-value carts and expedited shipping.
• Authorizations that pass AVS checks but fail CVV verification.
• Repeated orders of resellable goods sent to freight forwarders.
• Bulk purchases placed in the minutes after a card testing wave.

What to do when symptoms appear

1. Freeze the card in your bank app or call the number on the back of the card.
2. Dispute each unauthorized charge in writing and keep the confirmation number.
3. Request a new card number and a new CVV, not just a replacement card.
4. Change passwords on shopping accounts and turn on two-factor authentication.
5. Pull your free credit reports and check for accounts you did not open.
6. Save screenshots of statements and emails for the dispute file.
7. Report the incident to the FTC and, if losses are large, to the FBI IC3.

Lower your exposure

Keep the CVV out of saved merchant profiles and screenshots. Use a virtual card number for online checkout when the issuer offers one. Review statements every week rather than once a month, because test charges are designed to stay unnoticed. Merchants can cut losses by requiring CVV on every card-not-present order, blocking mismatched shipping addresses, and rate-limiting repeated declines from one device.

read more