What is CVV testing?

CVV testing is the process of checking whether a card security code passes the issuer's validation. It happens in two places: a sandbox, where developers confirm their checkout handles the gateway response, and a live checkout page, where criminals run stolen card numbers to see which ones still work. The first is routine QA work; the second is card testing fraud.

cvv testing method

What does a CVV check verify?

A CVV check compares the code a shopper types against the value the issuing bank holds for that card. The gateway passes the code to the issuer, and the issuer returns a one-letter result. PCI DSS forbids storing the code after authorization, so no merchant database keeps it.

more on this topic

What do CVV response codes mean?

• M (Match): the code matches the issuer's record.
• N (No match): the code is wrong.
• P (Not processed): the issuer did not run the check.
• U (Unknown): the issuer does not support CVV checks, which is common with some prepaid and non-US cards.
• S (Should be on card): the card should carry a code, but none was sent.

How do developers test CVV validation?

Test in the gateway sandbox, never against live cards. Stripe, Adyen, Braintree, and Authorize.net all ship test card numbers and test values that trigger a known CVV response. You can push a mismatch through your checkout and confirm the error copy, the retry path, and the order state.

more on this topic

• Use published sandbox numbers only.
• Cover all five response codes, not just M and N.
• Check what your code does when the gateway returns P or U.
• Confirm the CVV never lands in your logs, database, or analytics events.

What is card testing fraud?

Card testing fraud is the use of a live checkout to learn which stolen card numbers authorize. Attackers start with a small donation or a cheap item, then scale up once a card clears. The merchant pays in declined-authorization fees, chargebacks, and network fines.

read more

What are the warning signs?

• A burst of failed authorizations in a short window.
• Hundreds of card numbers hitting one checkout from a single IP or device.
• Repeated attempts on the same card number with small amounts.
• A run of N responses, or mismatched CVV and AVS pairs.
• Billing addresses that do not match the card issuer's country.

How do merchants stop card testing?

Rate limits and checkout friction kill most attacks. Add rules that flag velocity by IP, device, email, and card BIN. Then watch the numbers move.

• Require a CAPTCHA after several failed attempts from one session.
• Set your gateway to decline N responses and to review U and P responses.
• Cap authorization attempts per card, per hour.
• Turn on 3D Secure for orders that trip a risk rule.
• Feed decline data into a WAF or bot filter.
• Review authorization logs in real time, not in a weekly report.

Declining every CVV mismatch costs sales. Some issuers return N for a data-entry slip, so pair the CVV result with AVS and order history before you void an order.

Is CVV testing legal?

Testing your own card on your own checkout, or using sandbox numbers, is legal. Testing card numbers you do not own is access device fraud under 18 U.S.C. § 1029, and buying or selling stolen card data falls under the same statute. This guide covers the merchant and developer side only.

FAQ

What is the difference between CVV1 and CVV2?

CVV1 is encoded on the magnetic stripe and read when a card is swiped at a terminal. CVV2 (called CVC2 by Mastercard and CID by American Express and Discover) is the printed code used for online and phone orders. Both derive from the same keys, but from different data.

Does a CVV check stop fraud on its own?

No. The check catches a card number that someone copied without the physical card. A full card dump includes the code, so pair the check with AVS, 3D Secure, and velocity rules.

Can a merchant store the CVV after an order?

No. PCI DSS prohibits storing the card verification code or full track data after authorization. If your logs capture it, that is a compliance finding.

Why do some cards return a U response?

The issuer does not take part in CVV verification. Prepaid cards and some non-US issuers are the usual sources, so treat U as a risk signal rather than an automatic decline.