CVV Fraud Indicators: How to Spot Card-Not-Present Fraud

What counts as a CVV fraud indicator

A CVV fraud indicator is any signal that the three or four digit verification code on a card is being used without the cardholder's knowledge. No single signal proves fraud. Risk teams look for clusters: several mismatch declines on one device, many card numbers tried in a short window, and orders that ship to an address tied to none of the accounts. A compliant merchant never stores the code after authorization, so fraud shows up in the pattern of attempts, not in the data you hold.

more on this topic

Transaction-level indicators

• Repeated CVV mismatch responses on the same card in one session.
• One card number attempted with several different expiration dates or billing ZIP codes.
• Billing address that passes the street check but fails the ZIP check, or the reverse.
• Small authorization amounts, often under five dollars, followed by a large charge.
• Issuer decline codes such as "do not honor" followed by an approval after one detail changes.
• Card numbers that fail the Luhn check or show a BIN that does not match the issuing bank.

Patterns across orders

1. Count how many distinct card numbers came from the same device fingerprint in the last 24 hours.
2. Compare the shipping address against the billing address on each order.
3. Flag accounts where the email address changes right before a high-value purchase.
4. Review order velocity by IP subnet, not just by single IP address.
5. Check whether the same product and quantity repeat across many new accounts.

Device and network signals

• Proxy, VPN, or data center IP ranges at checkout.
• Browser fingerprints that repeat across unrelated accounts.
• Emulators or headless browsers with no rendering history.
• Time zone and language settings that conflict with the shipping country.
• Autofill that fills card fields but leaves contact fields empty.

Behavioral and support signals

• Buyer asks to split one order across several cards.
• Buyer requests expedited shipping to a freight forwarder.
• Chat messages that rush the agent or push for a manual override.
• Disputes filed before the delivery window closes.

Steps to take when indicators stack

1. Pause fulfillment and hold the order for manual review.
2. Run the cardholder through your processor's verification tool.
3. Ask the buyer for a billing statement or bank contact confirmation.
4. Decline the order and refund the original payment method if the buyer cannot verify.
5. Add the device fingerprint, IP, and email to your blocklist.
6. File a report with IC3 if the pattern points to an organized ring.

Signals that mislead

Address mismatch alone is weak. People move, use work addresses, and buy gifts. A single declined card means little, since banks decline legitimate charges for many reasons. Treat each indicator as one vote and act only when several point the same way.

CVV Fraud Detection Signs: Identifying Credit Card Scams