CVV Test SCA Guide: Strong Customer Authentication Explained

A CVV test in an SCA environment is a fraud tactic that runs small charges to confirm a card number, expiry date, and security code are valid, and to see whether the issuer skips Strong Customer Authentication. Under PSD2 and similar regimes, issuers must apply SCA to most card-not-present payments, so a charge that clears without a 3D Secure prompt tells a criminal the card is usable for larger purchases. Legitimate merchants do not test CVVs this way; they verify the code once, at checkout, through their payment processor. Buying, selling, or testing card data you do not own is a crime in the United States and most other jurisdictions.

read more

What is a CVV, and what does it actually verify?

A CVV is the three or four digit code printed on a payment card, separate from the card number and the PIN. It exists to prove the person entering the card details physically holds the card, which is why it is required in card-not-present transactions. A correct CVV confirms the data matches issuer records; it does not confirm the buyer is the account holder.

CVV Test SCA Overview: A Guide for Buyers and Sellers

What does SCA require at checkout?

Strong Customer Authentication requires at least two independent factors drawn from three categories: something the customer knows, something they hold, and something they are. In practice a card payment is confirmed with a password plus a one-time code, an in-app approval, or a biometric check. PSD2 applies SCA to most electronic payments in the European Economic Area, with narrow exemptions for low-risk, low-value, or trusted-beneficiary transactions.

read more

How does card testing appear to a merchant?

Card testing shows up as a burst of small authorizations from the same IP range, device fingerprint, or email pattern, often across many cards in a short window. Approval rates spike, then chargebacks follow weeks later when the real cardholders dispute the charges. Payment processors flag these patterns because they match known carding behavior rather than genuine customer demand.

Why does SCA reduce CVV testing?

SCA breaks the test. When an issuer forces a 3D Secure challenge, someone holding stolen card data cannot complete the second factor, so the transaction fails and the card is burned for that merchant. This is why card-testing operations target merchants with weak or exempted authentication, and why acquirers watch exemption usage closely.

What are the penalties for buying or selling CVVs?

In the United States, trafficking in access devices is prosecuted under 18 U.S.C. 1029, which carries fines and prison terms that scale with the volume and value of the cards involved. States add their own identity theft and computer crime charges. Card networks also blacklist merchants and processors tied to carding activity, ending their ability to accept payments.

How do merchants detect and block CVV testing?

• Rate limits on payment attempts per IP address, device, and card BIN.
• Velocity rules that reject repeated low-value authorizations from one source.
• SCA or 3D Secure required for first-time customers and unusual geographies.
• Address verification and CVV checks used together, never alone.

Frequently asked questions

Can a merchant store CVV data to test later?

No. PCI DSS prohibits retaining the CVV after authorization, so no compliant processor can keep it for later checks.

Does a passed CVV check mean a payment is safe?

No. Card testing exists precisely because a valid CVV can belong to a stolen card, and the code proves possession of the plastic, not ownership of the account.

Is a CVV test the same as a card authorization?

No. A normal authorization places a hold for a real purchase, while a test is a deliberate probe of whether the card works and whether authentication is enforced.