CVV Brute Force Attack: How It Works and Why It Fails

A CVV brute force attack is a carding technique that submits one card number with many different CVV values until a merchant approves a transaction. Also called CVV enumeration or a BIN attack, it targets checkout pages that check the security code without limiting repeated failures. It is a federal crime in the United States under access device fraud law, and modern payment networks are engineered to detect it.

What exactly does a CVV brute force attack target?

The CVV2 is the three digit code on the back of most cards, while American Express uses a four digit CID on the front. The issuer, not the merchant, verifies that code during authorization.

An attacker who holds a card number but not the code has a small search space to cover, since a three digit value only has 1,000 possible combinations. Enumeration tries those values in bulk across one merchant or many.

The objective is to turn a stolen number into a working card-not-present approval, or to validate a batch of numbers before reselling them to someone else.

Why do CVV brute force attacks usually fail?

• Issuers cap authorization attempts per card and per merchant, then block the card or force step-up authentication.
• 3-D Secure challenges a large share of high-risk attempts before any approval is issued.
• Payment gateways flag repeated declines from the same IP address, device fingerprint, or browser session.
• Address verification mismatch, geographic mismatch, and unusual merchant categories push risk scores higher.

A small search space does not mean easy access. Every failed attempt is a logged, billable event that leaves a detailed trail for fraud analysts.

Is buying or selling CVV data legal?

No. Trafficking in card credentials violates federal access device fraud statutes and can bring prison time, fines, and restitution orders.

Sites that advertise CVV data are often scams that collect payment and deliver nothing of value, or they operate under investigator surveillance.

Anyone who buys, sells, or uses another person's card details without authorization carries both criminal and civil exposure, regardless of where the marketplace is hosted.

How do merchants detect and stop enumeration attempts?

1. Rate limit failed CVV and authorization attempts by card number, IP address, and device.
2. Enable 3-D Secure for all card-not-present traffic.
3. Require a CVV and address verification match on high-risk orders.
4. Monitor decline spikes and block offending ranges at the gateway.
5. Never store CVV or other sensitive authentication data after authorization, as PCI DSS requires.

What should cardholders do?

Review statements often, turn on transaction alerts, and request a new card number if you see unfamiliar authorization attempts on your account.

Report unauthorized charges to the card issuer right away, and file a complaint with the FTC so the pattern is documented.