New CVV Test: How Card Verification Checks Work

A CVV is the three- or four-digit security code printed on a payment card, and a "new CVV test" is a check that a card number and its code match. Payment networks run that check during every authorization. Fraud rings also run it against stolen card data, which is card testing, and that is a federal crime in the US under 18 U.S.C. § 1029.

current cvv test procedures

This guide covers both sides: how a real CVV check works, why codes fail, and how merchants and cardholders spot testing attacks.

current cvv test procedures

How does a real CVV check work?

The printed code (CVV2 at Visa, CVC2 at Mastercard, a four-digit CID at American Express) is not stored on the magnetic stripe or the chip. It sits on the card surface and in the issuer's database. A merchant can send it for checking but cannot pull it from a swipe.

Top CVV Testing Tools for 2023

1. The cardholder enters the card number, expiry date, and security code at checkout.
2. The merchant sends that data to its payment processor, which routes it to the issuing bank.
3. The issuer compares the code with the value on file and returns an approval, a decline, or a specific mismatch code.

PCI DSS rule 3.2 forbids storing the code after authorization. Any site that offers to show you a stored CVV is lying or breaking the standard.

Why does a CVV check fail on a valid card?

Most mismatches are boring. The cardholder typed the wrong digits, or the card was reissued with a new code after a renewal or a replacement.

• Typo or transposed digits. The code has three or four digits and no name on it, so people mix it up with the PIN.
• Card type confusion. American Express uses four digits on the front. Visa, Mastercard, and Discover use three on the back.
• Reissued card. A lost, stolen, or upgraded card arrives with a new number and a new code.
• Virtual cards. Single-use numbers from privacy tools often come with a code that rotates or expires fast.
• Issuer block. The bank may decline the code check because it flagged the region, the merchant category, or the velocity of attempts.

Why is "CVV testing" fraud instead of a shortcut?

Card testing means sending many small authorization requests to find live numbers or guess codes. Each attempt costs the merchant an interchange fee, and a successful hit turns into a chargeback later. The pattern is one of the loudest fraud signals in payments.

Buying or selling stolen card data violates 18 U.S.C. § 1029, which covers fraud in connection with access devices. Convictions carry fines and prison time, and card networks ban the merchants involved.

Most "buy CVV" sites are scams stacked on top of that. Buyers pay in crypto and receive data that fails the first check, and sellers get traced when law enforcement follows the marketplace. There is no legitimate market for other people's card codes.

How do merchants detect card testing?

Card testing leaves a fingerprint: dozens of tiny charges in minutes, many declines, then a few approvals. Fraud tools score these signals before the charge settles.

• Velocity spikes. Many attempts from one IP address, device, or email in a short window.
• Small amounts. Test charges of $0.50 to $3 followed by a large purchase.
• Decline clusters. Repeated declines inside one BIN range point to a generated list of numbers.
• Location mismatches. Card issued in one country, IP address in another, shipping address in a third.
• Repeated fields. The same card number tried with slight changes to name, ZIP, or expiry.

Practical defenses include CAPTCHA on checkout, CVV required for every card-not-present charge, address verification, rate limits per IP, and 3-D Secure step-up for high-risk orders.

How can cardholders protect themselves?

• Use virtual or single-use card numbers for unfamiliar sites.
• Turn on transaction alerts for any charge over a set amount, and check small charges too.
• Never send a photo of the front and back of a card to anyone who asks in a chat or email.
• Freeze the card from the issuer's app the moment something looks wrong.
• Report fraud to the issuer, then file a report with the FTC at ReportFraud.ftc.gov.

Frequently asked questions

Is a CVV the same as a PIN?

No. A PIN is a secret the cardholder chooses and enters on a keypad. A CVV is printed on the card and proves the physical card is present.

Can a merchant store my CVV?

Not under PCI DSS. The code may pass through a processor during authorization but must not be written to a database, log, or receipt.

What should I do if my card was tested?

Freeze the card in the issuer's app, request a replacement with a new number, and review recent charges. Then file a report with the FTC and keep the confirmation number for your dispute.

Does a valid CVV mean a card is safe to accept?

No. A matching code only confirms the digits. Stolen data can carry a correct code, which is why velocity checks, address verification, and 3-D Secure still matter.