CVV Test and SCA Guide: Card Testing and Merchant Defense

Short answer

Strong Customer Authentication (SCA) is a PSD2 rule in the EEA and the UK. It covers most card-not-present payments. It requires two factors from three categories: knowledge (password, PIN), possession (phone, hardware token), inherence (fingerprint, face). The CVV printed on a card is not a valid SCA factor. It is card data, not proof of possession, and it cannot be stored after authorization. A "CVV test" in fraud terms is card testing, also called card enumeration. Someone pushes many card numbers through a payment form with small amounts to learn which ones authorize. SCA and CVV checks change the result.

cvv test sca guide

What SCA requires

• Two factors from different categories.
• Applies to EEA and UK card-not-present payments.
• PSD2 took effect 14 September 2019. The UK FCA set 14 March 2022 as the enforcement date for online transactions.

Exemptions

• Low value: under EUR 30, capped at five consecutive transactions or EUR 100 cumulative.
• Transaction Risk Analysis: issuer and acquirer fraud rates must stay under set thresholds. Ceilings run from EUR 100 to EUR 500.
• Recurring transactions of the same amount to the same merchant.
• Merchant-initiated transactions.

A merchant can request an exemption. The issuer decides.

CVV Test SCA Overview: A Guide for Buyers and Sellers

What a CVV check does

Visa CVV2, Mastercard CVC2, and American Express CID are 3 or 4 digit values. The issuer verifies them at authorization. A mismatch returns a specific decline code. Two limits matter. First, CVV is static. It does not change per transaction. Second, PCI DSS prohibits storing CVV2, CVC2, or CID after authorization. That rules CVV out as an SCA factor.

cvv test sca tutorial

A correct CVV does not prove the person holds the card. Card data leaks in bulk, and enumeration attacks harvest it.

What card testing looks like in logs

• Many authorization attempts from one IP range or device fingerprint in a short window.
• Amounts from USD 0.01 to USD 1.00.
• PANs that cluster inside a few BIN ranges.
• High CVV mismatch rate with low AVS match rate.
• Email addresses with random strings and no order history.

Attackers use the responses to sort live cards from dead ones. Declines are the product. A merchant with a permissive gateway becomes a free validation service.

Controls that cut the exposure

1. Block duplicate authorization attempts on the same PAN inside a short window.
2. Rate limit by IP, device, and email domain.
3. Set a floor amount. Reject authorization requests under that threshold.
4. Require 3DS for new customers and for BINs with prior fraud.
5. Log authorization attempts with response codes, not just settled orders.
6. Send declines to your fraud vendor, not only approvals.

Numbers to track

Watch the ratio of authorization attempts to successful orders. Watch CVV mismatch rate by BIN. Watch the share of attempts under USD 1.00. A jump in any of the three points to enumeration. The data is in your gateway logs, not in your order table.

Unknown: total enumeration volume in any single market. Acquirers hold that data and do not publish it in full.