CVV Attack Mitigation Instructions for Merchants

CVV attack mitigation instructions reduce to four controls: enforce CVV and AVS verification on every authorization, cap transaction velocity per card, IP, and device, place a bot challenge in front of checkout, and watch authorization logs for bursts of small declines. Merchants that layer all four typically contain a card testing run within minutes rather than discovering it weeks later through chargebacks.

cvv attack mitigation guide

What Is a CVV Attack?

A CVV attack, also called card testing or an enumeration attack, is a run of automated authorization requests that tries to confirm which stolen card numbers are still live. Attackers submit low-value transactions because a decline or an approval message tells them whether the card works. The goal is validation, not the purchase itself.

CVV Attack Mitigation Overview

Checkout and account-update pages are the usual targets because they accept card data without a logged-in purchase history. High approval rates make a merchant attractive, and the attacker can resell validated numbers on a wider market.

CVV Attack Mitigation Guide

Which Controls Stop a CVV Attack Fastest?

Start with verification rules, because they remove the feedback signal the attacker depends on. Then add rate limits and bot defenses to slow volume.

• Require CVV match on every authorization. Set the rule to reject on CVV mismatch or "not processed" rather than allowing the transaction through.
• Turn on AVS and require a street and ZIP match. Partial matches should trigger review, not automatic approval.
• Apply velocity limits per card number, per IP, per device fingerprint, and per email. Three to five attempts in an hour is a common threshold for manual review.
• Block disposable email domains and known proxy ranges at the checkout form.
• Deploy bot detection or a challenge such as a CAPTCHA or device attestation on the payment step.
• Require 3D Secure for new customers and for transactions above a low threshold.

How Do You Configure Velocity Rules Without Blocking Real Customers?

Score each rule instead of treating every trigger as a hard block. A single failed CVV check happens with honest typos; ten from one IP in a minute does not.

Set a hard decline at the high-confidence end and route everything in the middle to review. Revisit thresholds monthly against your own approval data so legitimate repeat buyers on shared networks are not caught in the net.

What Signals Show an Attack in Progress?

The clearest pattern is a spike in authorization attempts paired with a falling approval rate and a rising share of small-ticket orders. Watch for many distinct card numbers presented from one IP, one device, or one shipping address.

Other markers include a jump in CVV mismatches, an increase in zero-dollar or one-dollar authorizations, and new accounts that go straight to checkout without browsing. Alert on these metrics hourly, not nightly.

What Does a CVV Attack Response Checklist Look Like?

1. Confirm the pattern in your gateway logs and record the start time.
2. Raise velocity limits to block mode and tighten CVV and AVS rules.
3. Block the offending IP ranges, device fingerprints, and email domains.
4. Void authorizations that have not settled and refund any captured test charges.
5. Notify your acquiring bank and payment processor within their stated window.
6. Review the payment page code and third-party scripts for skimming or injection.
7. Document the incident, the timeline, and the rule changes for your next audit.

How Do You Recover After the Attack?

Expect a wave of chargebacks in the following weeks even after the traffic stops. Dispute test charges with the authorization logs, the CVV and AVS response codes, and the device data attached.

Recheck PCI DSS scope, because stored card data and weak transmission controls turn a nuisance attack into a breach. Encryption, tokenization, and a written security plan limit the damage when credentials leak.

Frequently Asked Questions

Does 3D Secure stop card testing?

It removes the simple approve-or-decline signal for most cards. Attackers can still test cards that are not enrolled, so pair it with velocity limits.

How many attempts per minute indicates an attack?

Any sustained rate above a few dozen authorizations per minute from a small set of IPs is abnormal for most merchants and warrants a block.