CVV Test SCA Process: Card Testing and Authentication

Short answer

A CVV test is a small charge run against a card number and its CVV to check if the card is live. SCA is the EU rule that forces a second factor on many card payments. Where SCA applies, a CVV test with no authentication fails. The issuer declines it or sends it to a challenge.

cvv test sca instructions

What a CVV test is

The CVV is the 3-digit code on the back of Visa, Mastercard, and Discover cards, and the 4-digit code on the front of American Express cards. PCI DSS forbids storing it after authorization. A CVV test sends a card number, expiry, and CVV to a payment gateway with a small amount, in most cases under $1, to see if the authorization returns an approval. Fraud groups run these tests in bulk across lists of stolen card data. The practice is card testing. It is a crime in the US under 18 U.S.C. 1029 and in similar statutes elsewhere.

read more

What SCA covers

Strong Customer Authentication comes from PSD2, the second EU payment services directive. The European Banking Authority set the compliance deadline at Sept. 14, 2019. SCA requires two of three factors: something the customer knows, something the customer has, and something the customer is. A card number plus a CVV is one factor. It is not two.

cvv test sca steps

The SCA process with 3D Secure 2

1. The merchant sends the transaction to the 3DS server with device and browser data.
2. The 3DS server passes that data to the card issuer.
3. The issuer runs risk checks. Low-risk payments pass with no customer step. This is the frictionless flow.
4. If risk is high, the issuer sends a challenge. The customer enters a one-time code or approves in a banking app.
5. The issuer returns an authentication result. The merchant submits the authorization with that result attached.
6. Exemptions exist: low-value transactions under 30 EUR, recurring payments of the same amount, and transaction risk analysis. Issuers cap how often exemptions apply.

Where card testing meets SCA

An unauthenticated test in the EEA hits a wall. The issuer sees an authorization request with no 3DS result and no exemption. It declines. Testers then look for merchants outside SCA scope, such as US merchants selling to US cardholders, or for gateways with 3DS switched off. That shift is one reason card testing shows up on US e-commerce sites.

Detection signals

• Many authorizations from one IP address or device in a short window.
• Amounts of $0.00 to $1.00 in sequence.
• Card numbers that fail the Luhn check or share a BIN range.
• Multiple declines followed by one approval.
• Billing address and IP country mismatch.

Merchants block these patterns with velocity limits, CAPTCHA at checkout, and rules at the gateway. Acquirers monitor merchant accounts for high test volume and can freeze the account.

Legal position

Buying, selling, or using another person's card data without consent is a crime in the US and the EU. There is no legal market for CVV data. Sites that advertise CVV sales run on stolen data or on scams that take the buyer's money.