CVV enumeration detection is the practice of identifying automated attempts to guess card verification values by analyzing authorization traffic for patterns instead of single transactions. The strongest signals are a rising CVV or CVC mismatch decline rate, many card numbers tested in a short window, BIN clustering, small repeated ticket sizes, and device or IP reuse across dozens of cards. Because the CVV cannot be stored after authorization, detection has to run on live response codes and request metadata rather than on stored data.
What is CVV enumeration?
CVV enumeration is a card-testing technique in which an attacker submits many card numbers paired with guessed three- or four-digit verification values to find combinations that authorize. Attackers usually start with a batch of numbers from a breach or a purchased list, then let the payment gateway tell them which pairs succeed. Each approval converts a blind guess into a confirmed, sellable card record.
The attack is cheap because most gateways return a distinct decline reason for a CVV mismatch versus an invalid card number. That difference is exactly what the attacker needs to narrow the search.
Which signals reveal CVV enumeration?
No single rule catches enumeration. Detection works by combining several weak signals into one score.
What Is CVV Enumeration? Definition, Mechanics, and Detection
- CVV mismatch spike. The share of declines coded as CVV or CVC failure climbs well above your normal baseline.
- Authorization velocity. One IP address, device fingerprint, or session attempts far more authorizations per hour than a real shopper.
- BIN concentration. Many distinct card numbers arrive from the same issuer identification number or from sequential ranges.
- Ticket-size clustering. Attempts bunch at the lowest possible order value, often a single low-priced item or a donation-style checkout.
- Identity mismatch. Cardholder name, email, billing address, and shipping details disagree across attempts that share a device.
- Approval-to-decline ratio. A low but nonzero approval rate is typical of enumeration, since the attacker keeps testing until something clears.
- Zero-value or micro-authorizations. Repeated small verification requests against many card numbers.
How do you set detection thresholds?
Start with a measured baseline, not a guess. Pull 60 to 90 days of authorization logs and calculate the normal rate of CVV mismatches, declines per IP, and distinct cards per device. Set alerts at a fixed multiple of that baseline, such as three times the median, and review them weekly.
Layer velocity rules on top: more than a set number of distinct card numbers from one device or subnet within an hour should trigger a challenge. Score rules together so a single odd transaction does not block a genuine customer.
What should you do when detection fires?
Prefer friction over hard blocks at first. Insert a step-up authentication challenge such as 3-D Secure, add rate limiting per IP and per device, and require CAPTCHA on the checkout endpoint. Hard-block the offending IP ranges and BIN ranges only after confirming the pattern.
Escalate to your acquiring bank and gateway when the volume is large. Acquirers track card-testing activity and can apply network-level filters that stop the traffic before it reaches your checkout.
Why can't you just store CVVs to compare later?
PCI DSS forbids retaining the CVV, CVC, or CAV2 value after authorization completes, even in encrypted form. That restriction means detection must rely on real-time gateway responses, decline codes, and request metadata. Merchants who keep verification values for analytics put themselves out of compliance and create a breach target.
Is CVV enumeration the same as card testing?
Card testing is the broader attack. CVV enumeration is one variant that focuses on validating the verification code attached to a card number. Both show up as bursts of low-value authorization attempts with high decline rates.
How fast does enumeration traffic appear?
A single attacker can push thousands of attempts in minutes with scripted requests. Detection windows measured in hours are often too slow, so velocity rules should evaluate in near real time.
Do chargebacks reveal enumeration after the fact?
Sometimes, but late. Approved cards from a testing run are often resold and used elsewhere, so the chargeback may land at a different merchant. Detecting at authorization time is far cheaper than absorbing fraud losses later.