CVV Testing Attack: What It Is and How to Stop It

Short answer

A CVV testing attack is an automated run of small payment attempts against a checkout page to learn which card numbers, expiration dates, and security codes are still valid. It is a form of carding. The person behind it does not want the product. The person wants a sorted list of working card data to resell or reuse. Merchants absorb the damage through chargebacks, processor fees, and account shutdowns, and cardholders absorb the rest.

Understanding CVV Vulnerability Exploits: A Comprehensive Guide

What the attack is trying to learn

Payment pages return different responses for a declined card, a card with a bad security code, and a card that authorizes but fails a later check. An attacker submits thousands of guesses to map those responses. Each guess uses a low dollar amount so the attempt looks like an ordinary small purchase. Working combinations get pulled out and the dead ones get discarded. The whole run can finish in minutes.

cvv verification breach

Signals to watch

• A burst of orders with the same amount, often under a few dollars.
• Many different card numbers from one IP address or device fingerprint.
• A decline rate that jumps from a few percent to most of your traffic.
• Checkout sessions that skip product pages and land on payment directly.
• Orders shipped to addresses that do not match the billing country.

Prevention steps

1. Require the CVV and postal code on every transaction, and set the gateway to decline on a mismatch instead of sending the order to manual review.
2. Turn on 3-D Secure so the issuing bank authenticates the cardholder before the charge settles.
3. Set velocity limits on failed attempts per IP address, per card fingerprint, and per email address in a rolling window.
4. Add a challenge step, such as a CAPTCHA, to the checkout and account creation forms.
5. Throttle or block traffic from hosting providers, VPN ranges, and known bot networks.
6. Write rules that block cards issued in countries you do not ship to, and review those rules each quarter.
7. Pull an authorization log daily and look for clusters of declines tied to one amount or one source.

If an attack is already running

1. Drop the failed-attempt limit to a single attempt per source and block repeat offenders.
2. Call the fraud team at your payment processor and ask for a rule review on your account.
3. Void or refund the small test charges that settled, and flag those card numbers in your system.
4. Alert your acquirer before the chargebacks arrive so the account is not frozen without notice.
5. Hold every new order for manual review until the failed-attempt rate returns to normal.

Legal note

Buying, selling, or using stolen card data is a crime under wire fraud and identity theft statutes, and card networks fine acquirers when it happens on their watch. There is no legal marketplace for CVV data. Any site that claims to offer one is either a scam that takes the buyer's money or a law enforcement operation.

read more