A CVV guessing attack is an attempt to find a card's verification code by trying values until one is accepted. The math is not the hard part. One thousand combinations cover a three-digit code, ten thousand cover the four-digit code on American Express. What stops the attack is that issuers and merchants both count attempts, and a card that trips the counter stops being useful to anyone.

cvv attack simulation

What the code actually is

Cards carry more than one verification value. The one printed on the front near the number is used for in-person and magstripe checks. The one on the back, usually called CVV2 or CVC2, is what online checkouts ask for. There is also a version that lives only in the chip or the token, and that one never gets typed by a human. Guessing attacks target the printed back code because it is the only one an attacker can submit through a web form.

more on this topic

Why the odds are worse than 1 in 1,000

Three things break the arithmetic in the issuer's favor. First, most issuers allow only a handful of wrong CVV attempts on a single card before they block it or flag the account. Second, a wrong code usually comes back as a generic decline, so the attacker cannot tell a bad CVV from a bad card number, a closed account, or a fraud block. Third, the address verification check runs at the same time, and a mismatch there turns a correct CVV into a decline anyway.

CVV Attack Tool: What It Is and Why Buying CVV Data Fails

Serial guessing on one card is close to useless. Attackers know this, which is why the real pattern is one or two tries per card across thousands of cards.

CVV Enumeration Test: A Guide to Where to Buy CVV

The real damage is card testing, not the guess

That pattern has a name: card testing, or card enumeration. Someone with a list of stolen numbers runs small authorizations, often a dollar or less, across a checkout page. A success tells them the number is live. A failure tells them it is dead and can be dropped from the list. The CVV attempt is a side effect of the sorting process, not the goal.

For a merchant, that traffic looks like a spike in tiny orders, many from the same IP range, often on digital goods or anything delivered instantly. The chargebacks arrive weeks later, and by then the authorization fees and the fraud ratio damage are already booked.

Signals worth watching in your own logs

• Many orders in a short window from one device or a rotating set of proxies
• Decline rates far above your normal baseline on a single payment page
• Repeated attempts on the same card number with different expirations or codes
• Billing and shipping details that are valid but do not match each other
• Order values clustered just under a fraud review threshold

Controls that actually help

Velocity limits are the first line. Cap attempts per card, per IP, and per device, and make the cap tight enough that a thousand guesses would take weeks. Address verification and CVV checks should both be required for card-not-present transactions, not treated as optional fields. 3-D Secure shifts the risk decision to the issuer and adds a step that scripted traffic struggles with. Device fingerprinting and a challenge on suspicious sessions catch the rest.

One more thing worth stating plainly: PCI DSS forbids storing the CVV, the full magstripe data, or the PIN block after authorization. A merchant who saves those values is not just out of compliance, they have built the exact database an attacker wants. If you handle payments, confirm that the code never lands in your logs or your order table.

If you are the cardholder

A block or a fraud alert on your card after unfamiliar small charges is a good sign, not a bad one. Call the number on the back, ask for a replacement number, and check whether any recurring billing was set up during the window. The issuer usually catches this before you do, because the attempt counter does the work.