CVV Fraud Rules: How Card Verification Codes Get Checked

The short answer

CVV fraud rules are the checks that card networks, issuers, and merchants apply to the 3 or 4 digit verification code printed on a payment card. Those rules decide whether a transaction proceeds, gets declined, or gets pulled for manual review when the code does not match what the issuer has on file. The code matters because it is one of the few pieces of card data that cannot be lifted from a magnetic stripe or a chip transaction log.

Three layers, not one

People talk about "the CVV rule" like it is a single setting. It is not. Three separate parties run their own rules, and a transaction has to clear all of them.

• Network rules define what the verification value is and what response codes issuers send back. Visa calls it CVV2, Mastercard calls it CVC2, American Express uses CID.
• Issuer rules decide what to do with a bad or missing code, how many retries to allow, and when to block the card outright.
• Merchant and processor rules decide whether to submit the code at all, and what to do with the answer once it arrives.

What the validation response actually says

When a merchant sends a verification value in the authorization request, the issuer does not reply with a plain yes or no. It returns a code, and the code is the whole point.

• Match. The value supplied matches what the issuer has.
• No match. The value is wrong. This is the signal fraud teams watch hardest.
• Not processed. The issuer could not check it, usually a processor or data issue.
• Not supported. The issuer does not participate in verification for that card.
• Should have been present. The merchant left the field blank on a card type that requires it.

A single mismatch is weak evidence. Cardholders mistype digits all the time. A mismatch paired with a billing address mismatch, on a card that has never transacted with you, is a different story.

The rules that catch carding traffic

What actually stops bulk card testing is not one check. It is combinations, plus limits on how many times a card can be tried.

• CVV plus AVS pairing. Both failing on the same order is the strongest single signal most merchants have.
• Retry caps. Issuers and processors count how many times an authorization is attempted against one card number in a short window. Real cardholders do not submit eight variations of an address in four minutes.
• Velocity by BIN. A cluster of declines across many cards sharing a bank identification number suggests a batch, not a customer.
• Shipping and billing divergence. A mismatch between the cardholder address and the destination is a classic reshipping pattern.
• Device and network signals. New device, mismatched IP geolocation, and disposable email domains all stack onto the CVV result.

Why CVV-only screening fails

Any merchant that treats a match as proof of a legitimate cardholder is going to absorb losses. The code protects against someone reading a card number off a receipt or a database dump. It does not protect against a full set of card details being captured together, which is how most card-not-present fraud reaches a checkout page in the first place. Fraud rings understand the checks better than many small merchants do, and they build their traffic to look ordinary: residential proxies, aged email accounts, orders sized to avoid review thresholds.

The legal side, plainly

In the United States, buying, selling, or trafficking in card verification data is a federal offense under 18 U.S.C. Section 1029, and prosecutions routinely pair that charge with identity theft and conspiracy counts. Marketplaces that advertise CVV data operate in the same legal category as the people using it. There is no version of that trade that is legal, and there is no version of it that is safe for the seller either, since these forums are saturated with law enforcement operations and with scammers targeting each other.

What a merchant should actually do

1. Always submit the verification value for card-not-present transactions. Skipping it usually raises your interchange and removes your chargeback protection.
2. Treat a mismatch as a review trigger, not an automatic decline. Hard-declining everything trains good customers to leave.
3. Cap authorization attempts per card number, per hour, at a low number.
4. Layer address verification, velocity, and device signals rather than relying on any one of them.
5. Log the response codes. Patterns only show up when you can query them later.

The rules are not complicated. They are just easy to ignore until the chargebacks arrive.