What is a CVV test?

A CVV test is a check that compares the 3-digit code on the back of Visa, Mastercard, and Discover cards, or the 4-digit code on the front of American Express cards, against the issuer's records. The payment network carries that code with the authorization request, and the issuer answers with a match, a mismatch, or no answer at all. During a normal purchase the test happens once, inside an encrypted payment form.

related article

What does a good CVV test experience look like for shoppers?

Shoppers should see one short field, and it should behave the way a phone keypad does. The code is used for a single authorization and then discarded, so the form should never ask for it twice.

CVV Test Interface: A Guide to Where to Buy CVV

• A field labeled "Security code" with the card brand visible, so the shopper knows which side of the card to read.
• A numeric keyboard on mobile, four-character maximum, with no spaces or dashes accepted.
• A specific inline error such as "Check the 3-digit code on the back of your card," not a generic failure notice.
• One retry, then a message directing the shopper to the number on the back of the card.

How do merchants test CVV handling safely?

Merchants check their checkout by using processor-supplied test card numbers in sandbox mode, never a live account. Stripe, Adyen, and similar processors publish test numbers that trigger specific CVC match, mismatch, and unchecked responses, so developers can confirm every branch of their code. A sandbox test verifies the integration, not a real card, and it leaves no card data behind.

cvv test user experience

Why is card testing a problem for merchants?

Card testing is a fraud pattern in which a criminal runs many small authorizations to find numbers that still work. The traffic arrives in bursts, often from a small set of IP addresses, and it produces a spike in declines and chargebacks. Repeated attacks can raise a merchant's fraud costs or get the account flagged by the processor.

cvv test user experience

Can a CVV test tell you whether a card is valid?

Only the issuing bank can answer that, and it answers only the merchant that submitted the authorization. Testing card numbers you do not own is fraud in the United States under laws covering unauthorized use of access devices, and it carries federal penalties. This guide does not cover buying, selling, or checking card data that belongs to someone else.

What do common CVV failures mean?

1. Mismatch: the code does not match that card, or the shopper typed digits from a different card.
2. Not supported: the issuer does not take part in code verification for that card type.
3. Unchecked: the network did not pass the code along, which often happens outside the US.

What red flags should shoppers watch for?

Any site that asks for a security code outside a checkout flow, or asks you to "verify" it by message or phone, is attempting phishing. A legitimate merchant asks for the code once, on a secured page, and never again through a support channel. If a checkout demands the code before showing a total, close the tab.