CVV testing software submits card numbers and card verification values to a payment page and reads the response. An approval marks the card as live. The tool has no legal consumer use. In the United States, making, selling, or using software to test payment cards falls under access device fraud in 18 U.S.C. § 1029. Products sold under this name are malware or a scam aimed at the buyer.

cvv testing software

What card testing does

A test is a small authorization, as low as $1, sent to a merchant checkout page. The response separates live cards from dead ones. Approvals mean the account is open. Declines, CVV mismatches, and address verification failures mark dead numbers. Fraud groups run these checks across many merchants so that no single site sees the full pattern.

CVV Testing Guide

Why the label is a red flag

No card network or payment processor sells software for testing cards you do not own. Listings on forums and messaging channels carry trojans that capture the buyer's machine, or they charge for a script that only hits merchant pages. In both cases the buyer loses money and gains no working tool. Reporting on carding forums shows the same pattern: sale posts with no verifiable vendor.

more on this topic

Legal exposure

18 U.S.C. § 1029 sets a maximum of 10 years for a first offense involving unauthorized access devices and 15 years for offenses involving 15 or more devices. Possession of 15 or more unauthorized access devices is a charge on its own. State statutes add separate penalties for identity theft and computer crime. Card networks also ban merchants and processors tied to card testing.

cvv testing software

How processors detect card testing

• Authorization velocity: many attempts from one IP address, device, or card range in a short window.
• High decline rates mixed with small approvals on the same merchant account.
• CVV and address verification mismatch rates above the account baseline.
• Device fingerprints that repeat across unrelated card numbers.
• Order patterns with no cart history, disposable email addresses, and mismatched billing data.

Issuers and acquirers share these signals. Visa and Mastercard publish card testing rules that let acquirers fine or terminate merchant accounts with sustained attack traffic.

What merchants can do

1. Rate limit authorization attempts per IP address and per device.
2. Require CVV and address verification on first orders.
3. Add a challenge step, such as 3-D Secure, when risk scores rise.
4. Block known bad IP ranges and disposable email domains.
5. Review small approvals for chargeback follow-up.

Reporting

Card testing attacks and carding losses can be filed with the FBI Internet Crime Complaint Center at ic3.gov. The FTC takes reports on identity theft and credit card fraud at IdentityTheft.gov. Merchants should also notify their acquirer, which can block the traffic and open a fraud case.