CVV fraud shows up as a card-not-present charge where the card verification value sent with the authorization request does not match the value the issuer holds. The issuer returns a CVV mismatch response. That signal is weak by itself. Fraud teams read it with address verification, order velocity, device data, and shipping details.

read more

What the CVV Check Does

Visa, Mastercard, and Discover print a 3-digit code on the back of the card. American Express prints a 4-digit code on the front. The issuer stores the value. The merchant sends it with the authorization request. PCI DSS Requirement 3.2 bars merchants from storing the value after the transaction settles.

related article

A correct CVV means the person entering the data has the physical card in hand. A thief who pulled a card number from a database breach does not have the CVV unless that breach exposed it. Full card data sells at a higher price than a number alone for this reason.

cvv fraud red flags

Merchant-Side Indicators

• CVV mismatch on the first attempt, then an approval on a second card from the same device.
• AVS fails while CVV passes, or the reverse. One pass and one fail points to mixed or partial stolen data.
• Billing address in one country, IP address and device in a second, shipping address in a third.
• Ten or more card numbers tried from one IP or device inside a few minutes.
• Test charges between $0.50 and $3.00 before a large order on the same account.
• Rush shipping on a first-time order with a high ticket total.
• One device fingerprint across accounts with different names and email addresses.
• Declines on the same card number at several merchants inside an hour.

Cardholder-Side Indicators

• A charge under $5 from a merchant you do not know.
• Two charges minutes apart for the same amount.
• A replacement card you did not request.
• A verification code by text or email for a purchase you did not make.

The Fair Credit Billing Act caps cardholder liability at $50 for unauthorized charges. Many issuers set it at $0.

cvv fraud signs

What to Do

Cardholders: freeze the card in the issuer app, then file a written dispute with the issuer. Report the charge to the Federal Trade Commission and to your state attorney general.

Merchants: run CVV checks at authorization, not just AVS. Review every order that mixes a CVV pass with an AVS fail. Set velocity limits per device and per IP. Flag any account that runs a small charge before a large one.