A CVV fraud test is a low-value authorization attempt that a criminal runs to check whether a stolen card number, expiration date, and CVV code still work. The person running it does not want the product. The goal is to sort live cards from dead ones before reselling them or using them for a larger purchase. On the merchant side, the same pattern appears as card testing: a burst of small orders, a high decline rate, and many attempts coming from a small set of IP addresses. Detecting and blocking that pattern is a payment operations task, not a mystery.

credit card fraud detection test

What the activity looks like in transaction data

A single CVV fraud test rarely stands out. Ten thousand of them do. Fraudsters work in batches because stolen card numbers go stale fast. That produces recognizable signals in your gateway logs: repeated attempts on sequential card numbers, identical device fingerprints, orders placed within seconds of each other, and dollar amounts that sit at or below the minimum your gateway allows. The CVV and AVS response codes on those attempts are often a mix of matches and mismatches, which tells you the attacker is guessing.

related article

How to detect card testing on your storefront

1. Export your authorization log for the past 30 days from the payment gateway, including response codes, IP address, and order value.
2. Group the log by IP address and count the number of attempts each one made in any single hour.
3. Flag every IP that exceeds your normal per-hour attempt rate for a store of your size.
4. Compare the card BIN country against the billing address country on each flagged order.
5. Pull the CVV and AVS response codes for the flagged attempts and mark the ones where both failed.
6. Check the timestamps for clusters of orders placed within the same few minutes at near-identical amounts.
7. Send the confirmed cluster to your payment processor's fraud team so the cards can be added to their block lists.

How to stop it before it reaches your gateway

1. Make CVV and AVS verification a hard requirement in the gateway settings, not an advisory check.
2. Set velocity limits per IP address, per card number, and per email address, and reject anything above the limit.
3. Add a CAPTCHA to checkout, account creation, and password reset forms.
4. Set a minimum order value in the gateway so zero-dollar and one-cent authorization attempts never reach the processor.
5. Turn on 3-D Secure for orders that score above your risk threshold.
6. Block or challenge traffic from anonymizing proxies and from IP lists your processor publishes.
7. Review chargebacks and fraud reports every week so a new pattern surfaces in days instead of months.

What cardholders should do

• Read your statement every week and look for small charges you did not make.
• Lock the card in your issuer's mobile app the moment something looks wrong.
• Dispute the charge with the issuer and ask for a replacement card number.
• Report the theft to the Federal Trade Commission at IdentityTheft.gov so the pattern is on record.

One rule matters more than the rest: do not store the CVV after authorization. PCI DSS prohibits keeping it, and a database full of CVV codes turns a routine breach into a card factory. If your system writes that field to disk, fix that before you tune anything else.

credit card fraud test