What a CVV is

CVV stands for card verification value. Visa, Mastercard, and Discover print 3 digits on the back of the card. American Express prints 4 digits on the front. The issuer generates the code and ties it to the account number. The code sits in the magnetic stripe and chip data as a separate field, so a copied stripe does not carry it.

How a CVV check works at checkout

The merchant sends the CVV inside the authorization request. The issuer compares it to the value on file and returns one of three results: match, no match, or not processed. A no match result can decline the sale or shift liability to the merchant. PCI DSS Requirement 3.2 bars merchants from storing sensitive authentication data, including the CVV, after authorization.

What "CVV test" means in card fraud

On fraud forums, a CVV test is a small charge aimed at a card number to learn if the account is open. The trade calls this card testing, carding, or enumeration. Attackers run batches of numbers against a payment page and watch which ones approve. The victims are cardholders, and the merchant absorbs chargebacks and network fines. Lists sold as "fresh" or "latest" carry no guarantee. The numbers are stolen either way.

Legitimate CVV testing

Payment processors publish test card numbers for developers. Stripe, PayPal, and Authorize.net list numbers such as 4242 4242 4242 4242, and 4000 0000 0000 0002 for a decline. These numbers run only in sandbox mode. No real account and no real person is attached. A sandbox check is not a card test.

US law on card data

18 U.S.C. 1029 covers access devices, a term that includes card account numbers. Producing or trafficking in counterfeit access devices carries up to 15 years in prison. Possession of 15 or more unauthorized access devices carries up to 10 years. Buying CVV data is trafficking in access devices.

This page does not list sellers, markets, or prices for card data. Sellers in that market hold numbers taken from account holders.

If a card number is exposed

• Call the number on the back of the card and ask for a new account number.
• Read 12 months of statements for charges under $5. Test charges are small.
• File a report at IdentityTheft.gov for a recovery plan and a written record.
• Send a complaint to the FBI Internet Crime Complaint Center at ic3.gov.

What this page does not cover

Rates of card testing losses by year are not stated here. Published figures vary by network and by merchant size. Sources for that data are Visa, Mastercard, and the PCI Security Standards Council.