Answer

CVV brute force detection rests on three counts: authorization attempts per card, attempts per device or IP, and the CVV mismatch ratio. A card that fails CVV verification three or more times in 24 hours across two or more IP addresses is a candidate for a brute force pattern. A device that submits more than 10 different card numbers within one hour is a second candidate. Neither rule catches everything. Together they catch most automated attempts.

CVV Brute Force Attack Explained: Protecting Your Financial Information

What the attack looks like

A brute force attempt tries many card numbers or many CVV values against a payment endpoint. The attacker holds a batch of card numbers, often from a breach, and lacks the three or four digit code. Software submits guesses until one passes. Real traffic shows a burst of declined authorizations, a small number of approvals, and repeated submissions from a narrow set of IP ranges or devices. Order values stay low, often under $10, because the goal is to test rather than to buy.

related article

Signals in transaction data

  • CVV2 response code 05 or the issuer equivalent, repeated on the same card number.
  • Address verification (AVS) result mismatch with a CVV pass, or the reverse.
  • More than five card numbers attempted from one device ID in an hour.
  • BIN ranges that do not match the shipping country.
  • Decline code sequences: do not honor, then insufficient funds, then pickup card, on one card.
  • Session times under 20 seconds from cart to authorization.
  • Identical user agent strings across many accounts.

Detection rules to set

  1. Count CVV failures per card number per 24 hours. Threshold: 3.
  2. Count distinct card numbers per device fingerprint per 60 minutes. Threshold: 10.
  3. Track CVV failure ratio per merchant account. Baseline first, then alert at 3 times baseline.
  4. Flag any card that receives a pickup card response. That code signals a stolen card record.
  5. Score IP reputation and block lists. Weight datacenter ranges higher than residential.

Response steps

Block the device and IP at the edge. Send the flagged card list to the acquirer and to the issuer through the normal fraud reporting channel. Void or refund approvals that came from the flagged session. Keep authorization logs for at least 12 months. PCI DSS Requirement 10 covers log retention and review for systems that touch cardholder data.

cvv brute force attack detection

Limits

Shared corporate cards and family accounts produce CVV failures that look like attacks. Rate rules create false positives on high volume subscription merchants. Detection also depends on what the issuer returns. Some issuers send a generic decline code for a CVV failure, which removes the clearest signal. In that case weight device and velocity counts higher. No rule set replaces review of the raw authorization log during an active incident.

What is a CVV Brute Force Attack?