CVV Test Checklist: Card Testing Fraud Prevention Guide

Short answer

A checklist for testing CVV values against live card numbers does not have a lawful version. Any guide that teaches how to validate stolen or guessed card data is a carding manual, and the request here sits squarely in that space. The phrase "buy CVV or sell CVV" describes the market for stolen payment credentials, and a test checklist is the tooling that makes that market work. I will not write it. What I can do is give you the checklist that belongs on the other side of the same problem: how a merchant, processor, or risk team detects and stops card testing attacks on their own checkout.

What card testing actually is

Card testing is the practice of submitting many small authorization requests to find out which card numbers and security codes are live. A fraudster who buys a batch of credentials needs to know which ones still work before using them on a high value purchase. The testing happens at merchants with weak controls, often digital goods, donation pages, subscription trials, and guest checkout flows. Each individual test looks tiny. Taken together, the pattern is loud: hundreds of attempts from a narrow set of addresses, most of them declining, a few of them approving, all within a short window.

Detection checklist for merchant and risk teams

• Watch authorization volume per IP address, per device fingerprint, and per email domain over rolling 10 minute windows, not just daily totals.
• Track the ratio of card verification failures to successful authorizations on the same card or the same customer identifier.
• Flag repeated attempts on sequential or BIN adjacent card numbers from one source.
• Review small value authorizations that arrive in bursts and are followed by no shipment, no login, and no support contact.
• Check your decline codes. A spike in do not honor and invalid card responses from one network segment usually points to guessing, not to a checkout bug.
• Compare new account creation rates against verified purchase rates over the same period.
• Confirm that your payment page rate limits by session, not only by account.

Parameter bands worth setting

Exact thresholds depend on your traffic, but useful starting bands look like this. Block or challenge after three to five authorization attempts on one card within a 15 minute window. Challenge when a single IP address produces more than ten attempts per hour across any number of cards. Alert when card verification failure rates for a single source exceed roughly 60 percent. Escalate when a BIN shows a decline rate several times your baseline in a 24 hour period. Recheck these bands quarterly, because attackers adapt and a threshold that worked last year may now sit above normal customer behavior.

Pitfalls

The common mistake is treating card testing as a chargeback problem. Chargebacks arrive weeks later, after the credentials have been resold and used elsewhere. Another mistake is rate limiting only at the account level, which leaves guest checkout wide open. A third is ignoring your own logs after a successful block: partial success teaches attackers which parameters to change next.

FAQ

Can a merchant test CVV values on their own?

Only through the network rules that govern your processor account, and only with authorization from the cardholder or issuer as applicable. Bulk validation of credentials you do not own is fraud regardless of how you frame it.

Is buying a CVV list ever legitimate?

No. Legitimate access to card data comes from the cardholder, the issuer, or a contracted processor under a written agreement.

What should I do if I think my own card was exposed?

Contact your issuer, request a replacement number, and review recent statements for small test charges.