A CVV test order is a small charge that a criminal runs on a stolen card number and its security code to find out whether the card is still active. The amount is tiny on purpose, often under a dollar, so the real cardholder sees nothing unusual. Running those orders is illegal in the United States and falls under federal access device fraud and wire fraud law.

read more

What is a CVV test order?

The CVV is the three digit code on the back of a Visa, Mastercard, or Discover card, and the four digit code on the front of an American Express card. It exists to prove that whoever is paying holds the physical card, not just the number. A test order is a purchase that ignores that proof and checks it instead.

cvv verification checkout

Criminals do not need the card in hand to run one. They need the number, the expiration date, and the code, which is exactly the package sold on stolen card markets. A test order is the step that separates a working card from a dead one.

CVV Test Payment Gateway

Why do criminals run test orders?

Card data gets traded in bulk, and a large share of it is stale. Banks cancel cards, cardholders replace them, and old numbers stop working. Test orders sort the live cards from the dead ones.

more on this topic

A card that passes a test can be resold at a higher price or used for a bigger purchase later. That is why the first charge on a stolen card is small and the second one often is not.

What does card testing look like in your transaction log?

Card testing leaves patterns. A single odd charge means little, but these signals together point to an attack:

• A burst of small charges, often $0.50 to $2, in a short window
• Many declines from one IP address or device, followed by approvals
• Different card numbers that share one shipping address or email
• Orders placed at 3 a.m. on low-traffic digital goods or gift cards
• Card numbers that fail the address verification check but pass the CVV check
• Checkout attempts that hit the payment page without browsing any products

Why do test orders hurt merchants?

Every fraudulent charge turns into a chargeback, and chargebacks carry fees that start around $15 to $25 each. A hundred $1 test orders can cost a merchant thousands in fees alone.

Card networks also track dispute ratios. A merchant with a high fraud rate lands in a monitoring program, pays fines, or loses the ability to accept cards. That risk is far larger than the value of the stolen goods.

How do merchants stop CVV test orders?

1. Require the CVV on every card-not-present sale. A missing code field invites testing.
2. Never store the CVV. PCI DSS forbids keeping it after authorization, even encrypted. Keep the result, not the code.
3. Turn on 3D Secure. EMV 3DS pushes authentication to the issuer and shifts fraud liability away from the merchant.
4. Set velocity rules. Limit attempts per card, per IP, per device, and per email in a rolling window.
5. Block bots at checkout. CAPTCHA, device fingerprinting, and rate limiting cut automated attacks.
6. Enforce address verification. Mismatched billing addresses on small orders are a common flag.
7. Watch digital goods. Gift cards, game credits, and trial signups attract testing because delivery is instant.
8. Review small orders like large ones. A $1 charge that clears is the setup for a $900 charge.

What are the legal consequences of running test orders?

Federal prosecutors charge card testing under 18 U.S.C. Section 1029, which covers fraud with access devices and carries fines and prison time. Related charges under wire fraud statutes often follow when the scheme crosses state lines.

Buying, selling, or holding stolen card data is a crime in itself, separate from any purchase made with it. There is no legal market for CVV data, and no legitimate site sells it.

What should a cardholder do after an unknown test charge?

1. Read the last two months of statements and note every charge you do not recognize.
2. Call the number on the back of your card and ask for a new card number.
3. Dispute the charge with the issuer in writing.
4. Report the fraud to the FTC at IdentityTheft.gov and keep the report number.

Frequently asked questions

Is it legal to buy CVV data?

No. In the US, buying, selling, or possessing stolen card data is a federal crime. Any site that offers CVVs for sale is trading in stolen financial records, and using one exposes the buyer to prosecution.

Is a $1 charge a sign of card testing?

Not on its own. Gas stations, hotels, and subscription services place small authorization holds that look the same. Several small charges from merchants you do not know, all in one week, are a much stronger signal.

Does a CVV check stop card testing?

No. Stolen card records often include the code, so a CVV match proves nothing about the person paying. Merchants pair the code check with 3D Secure, address matching, and velocity limits.

Can a merchant keep CVV numbers on file?

No. PCI DSS bans storage of the CVV after authorization. Merchants keep the authorization result and the last four digits of the card, not the security code.