A fake CVV test is an attempt to run a card number through a payment system with an invented or mismatched CVV code to see whether the account is live. Card networks do not publish test CVVs, and no legitimate processor or merchant sells card data. This guide covers how CVV validation actually works, how card testing shows up in authorization data, and how merchants and cardholders stop it.

related article

What does a CVV actually do?

The CVV is a 3 or 4 digit value generated from the card number, expiration date, and issuer keys. The issuer, not the merchant, validates it during authorization. Because the code proves the physical card was present at some point, PCI DSS rules prohibit merchants from storing it after a transaction is authorized.

Fake CVV Verification

Why do card testing attacks happen?

Fraudsters who obtain card numbers in bulk need to know which ones are still open before reselling or using them. They fire small charges across many accounts and watch which ones approve. A mismatched CVV that still approves tells them the issuer did not enforce CVV checking on that card.

related article

Why does a fake CVV usually fail?

Issuers compare the submitted code against the one on file, and a wrong code returns a specific decline response. Even when an issuer does not enforce CVV, the batch of rapid attempts itself triggers risk rules at the processor. That combination is why card testing is one of the loudest fraud signals in payments.

How to Fake CVV Check: A Guide

How do merchants detect card testing?

• Spikes in authorization attempts from a single IP address or device fingerprint.
• Many declines followed by a small number of approvals on low-dollar amounts.
• Card numbers arriving in sequential ranges from the same BIN.
• Address verification and CVV results that do not match the billing profile.
• Unusually high trial or donation form submissions in a short window.

Is buying or selling card data legal in the United States?

No. Trafficking in payment card numbers is access device fraud under 18 U.S.C. 1029, and it carries federal criminal penalties including prison time and fines. Buyers, sellers, and intermediaries all fall inside that statute. There is no lawful market for CVV data.

What should you do if your card is being tested?

1. Call the number on the back of your card and ask for a replacement with a new number.
2. Review recent statements for small charges you do not recognize.
3. Report identity theft at IdentityTheft.gov and file a complaint with the FBI Internet Crime Complaint Center.
4. Turn on transaction alerts so every authorization reaches your phone.

What should merchants do?

Enforce CVV and address verification on every card-not-present transaction, and decline rather than review on a mismatch. Rate limit checkout endpoints and block traffic that looks automated. Monitor decline-to-approval ratios daily, because card testing campaigns peak within hours and leave before a weekly report arrives.