CVV Brute Force: What It Is and Why It Fails

Short answer

A CVV brute force attack guesses the 3 or 4 digit card verification value by submitting many card-not-present transactions with wrong values. It fails in most cases. Issuers and payment gateways cut off the attempt after a small number of mismatches, and card networks score repeated failures as fraud. The attacker needs the full card number and the expiry date before the guess starts, so this is not a way to find a working card.

What the CVV is

Visa prints CVV2. Mastercard prints CVC2. American Express prints CID. The value sits on the card surface and is not encoded in the magnetic stripe or the EMV chip. For Visa, Mastercard and Discover it is 3 digits. For American Express it is 4 digits.

A merchant that takes card-not-present orders asks for the CVV to test whether the buyer holds the physical card. That check is one signal among several. Address verification, device fingerprint, IP country, order history and 3-D Secure also feed the decision.

Why the attempt fails

• Attempt limits. Issuers decline a transaction after one to three wrong CVV entries on the same card. The issuer then blocks online use or asks for a phone call.
• Fixed guess space. A 3 digit CVV has 1,000 possible values. A 4 digit CVV has 10,000. Authorizations are counted, not combinations, so a thousand tries never happens.
• Velocity rules. Gateways flag a card number or a device that produces several declines in a short window.
• Network scoring. Visa and Mastercard run fraud models on authorization traffic and report card enumeration patterns to acquirers.
• No storage. PCI DSS Requirement 3.2 bans keeping the CVV after authorization, so a breached merchant database does not hand over the value.

Detection signals merchants see

Risk teams look at the ratio of declines to approvals from one IP range or device. They also look at many card numbers tried against one merchant account, small test amounts, and billing data that does not match the card. A gateway that sees these patterns can block the traffic and freeze the account.

Legal exposure in the United States

Card verification values are access devices under 18 U.S.C. 1029. Buying, selling, transferring or using them without authorization is a federal felony. A first conviction carries up to 10 years in prison and a fine. A prior conviction under the same section raises the maximum to 15 years. State laws add separate counts for identity theft and computer intrusion.

What cardholders should do

1. Read the statement each month and check every card-not-present charge.
2. Report an unknown charge to the issuer. Federal law caps cardholder liability for unauthorized use at $50, and most issuers waive it.
3. File a report at IdentityTheft.gov if the card number shows up on more than one account.
4. Ask the issuer to reissue the card with a new number and a new CVV.

Scope note

This page describes the attack type and the controls that stop it. It does not list tools, scripts or card sources.