CVV Fraud Signals: How Risk Teams Detect Card Fraud

What counts as a CVV fraud signal

A CVV fraud signal is any data point in a card-not-present transaction that correlates with stolen card use. The CVV is the 3-digit code on the back of Visa, Mastercard, and Discover cards, or the 4-digit code on the front of American Express cards. A mismatch between the code the buyer submits and the code the issuer holds is the strongest single signal in an authorization response.

read more

Issuers return a CVV result with each authorization: M for match, N for no match, P for not processed, S for should have been present, U for unknown. Results of N and S raise fraud scores at most processors.

cvv fraudulent activity signs

Signals risk teams track

• CVV result of N or S on a card that approves elsewhere.
• AVS mismatch on street number and ZIP while the CVV matches.
• Many small authorizations from one IP in a short window. Card testing runs 10 to 100 attempts per hour.
• Billing country and IP country differ.
• One device fingerprint seen across 5 or more card numbers.
• Email domain registered less than 30 days before the order.
• Order value far above the card's normal ticket size.
• A string of declines followed by an approval on a second card from the same device.
• Proxy, VPN, or hosting-provider IP ranges.
• Shipping address 1,000 miles or more from the billing address, paired with expedited shipping.

Where the data comes from

Issuers, processors, and card networks share some signals through consortium databases. Merchants see the rest in their own logs. No single signal proves fraud. Two or more together raise the score and trigger a manual review or a step-up authentication request under 3D Secure.

cvv deception cues

Legal status in the US

Buying, selling, or possessing stolen card data is a federal crime under 18 U.S.C. § 1029. A first offense carries up to 10 years, a second up to 20 years. Card networks fine acquirers for excess fraud, and merchants absorb chargeback liability plus fees.

What PCI rules say about CVV

PCI DSS classifies the CVV as sensitive authentication data. Merchants may not store it after authorization, in any form. Systems that log CVV values fail assessment and face fines from the acquirer.