CVV testing, also called card testing, is an illegal fraud technique in which someone submits small transactions against many card numbers to learn which accounts are still active. In the United States it is a crime under federal and state law, it harms the cardholders and merchants whose accounts are used, and payment networks actively detect and shut it down.

CVV Testing Best Practices: A Guide to Secure Transactions

What CVV testing actually is

The card verification value, or CVV, is the three or four digit code printed on a payment card and used to confirm that the person entering a card number physically holds the card. Fraudsters who obtain card numbers from data breaches sometimes try to verify them by running low-value authorization attempts, hoping an approval will confirm a live account.

more on this topic

This is not a technical loophole. It is access device fraud, and it is treated as such.

cvv testing method

Why buying or testing CVVs does not work

• Breached card data goes stale fast. Banks cancel and reissue cards after a breach, often within days, so most numbers sold in bulk no longer authorize.
• Guessing the CVV is not realistic. The code is a short random value. Random attempts fail at a rate that makes volume testing unprofitable.
• Issuers and networks watch for it. Sudden bursts of small declined authorizations from the same device or network range trigger velocity rules, risk scoring, and manual review.
• The purchase itself is a crime. Buying or selling stolen card data is a separate offense from using it, and a card that never works does not remove liability.

The people who absorb the damage are real: cardholders dealing with a frozen account, and merchants hit with chargebacks, fees, and lost inventory.

cvv testing process

How merchants detect and block card testing

• Rate limiting checkout attempts and flagging repeated small declines from one source.
• Requiring the CVV and a matching billing address on every transaction, including low-value ones.
• Adding CAPTCHA or bot challenges at checkout and login.
• Enabling 3D Secure or similar issuer authentication for card-not-present payments.
• Alerting the payment processor as soon as an unusual authorization pattern appears.

What the law says

Federal law under 18 U.S.C. § 1029 covers fraud and related activity involving access devices, which includes payment card numbers and CVVs. Convictions carry felony penalties, including prison terms and fines. State prosecutors bring their own charges for identity theft and unauthorized use of a payment card, and regulators have brought civil actions against operations built around stolen card data.

For merchants, the compliance side matters too. The PCI Data Security Standard prohibits storing sensitive authentication data, including the CVV, after a transaction is authorized. Keeping that data creates liability far beyond any fraud loss.

If your card or business is affected

• Cardholders: report the unauthorized charge to the card issuer right away, then file a report with the FTC and, if money was lost, the FBI's Internet Crime Complaint Center.
• Merchants: contact your payment processor and acquirer, review order logs for bursts of failed small charges, and confirm that your systems never retain CVV data.
• Anyone offered stolen card data for sale: there is no legitimate market for it, and participating in one creates criminal exposure with no realistic upside.