Three things show up on most card-not-present orders that later turn into chargebacks: a CVV mismatch on an order that otherwise looks clean, a device that has touched more cards than one person could plausibly own, and a shipping address with no relationship to the billing address. Catch those three and you catch a lot. The rest is scoring, and scoring is where the real work lives.
CVV Fraud Indicators Synonyms: A Comprehensive Guide
A wording problem worth fixing
"CVV fraud" is shorthand, and it is imprecise. The CVV is a verification value printed on the card. It is not a fraud type. What people usually mean is card-not-present fraud where the criminal happened to hold the full card details, CVV included. That distinction changes what you hunt for. You are not looking for a bad CVV. You are looking for the behavior around a transaction where the CVV was supplied by someone who is not the cardholder.
Read CVV and AVS responses together
A CVV mismatch is the loudest single indicator on a card-not-present order. It is not proof. Cardholders mistype three digits, and a spouse on a shared card gets it wrong. But when CVV fails and address verification returns a full match, the mismatch usually means somebody had the card number and expiry from a breach and lacked the rest. The combinations matter more than either field alone:
cvv fraud indicators questions
- CVV mismatch with a full AVS match: elevated risk, worth a manual look before you ship.
- CVV match with partial AVS: common for customers who just moved. Lower priority.
- CVV mismatch and AVS mismatch together: declining here is cheaper than a chargeback.
- CVV responses of "not applicable": these reflect issuer non-participation, not a red flag by themselves.
Velocity and card testing
Card testing happens before the fraud. Someone runs a batch of stolen numbers through a checkout to learn which ones still work. The signature is a burst of small authorizations, often under five dollars, sometimes a dozen from one IP or device inside an hour. Then a large order arrives from the same fingerprint a day or two later.
CVV Fraud Indicators Compared to Traditional Security Measures
What I look at:
- How many distinct card numbers one device or IP attempts in a 24 hour window.
- Decline rate per card. One decline is noise. Five declines across five cards in one session is a test.
- Whether a successful order follows a string of failures from the same fingerprint.
- Time gaps between attempts. People pause. Scripts do not.
Device and identity signals
Device fingerprint reuse is the quiet workhorse. A phone or laptop tied to one customer is normal. The same fingerprint tied to fourteen card numbers in a month is not a customer, it is an operation. I also weigh email age and shape. Addresses created the same day as the order, random strings before the domain, and disposable mail providers all add points. Customer accounts with no order history that jump straight to a high-value cart add more.
IP data belongs here too, but use it carefully. Datacenter ASNs, residential proxies, and IP geolocation that disagrees with the billing country are useful signals. They are also noisy, since plenty of honest shoppers use VPNs. Treat them as weights, not gates.
Order and shipping signals
- Expedited shipping on a first-time order for resale-friendly goods.
- Different names on the card, the account, and the shipping label.
- Freight forwarders and known reshipper addresses.
- Multiple orders in a short window to the same address from different cards.
- Cart contents that look like inventory rather than personal use, such as five identical items.
What looks alarming but usually isn't
A billing and shipping mismatch alone is weak. Gifts, students, and split households produce it constantly. A brand new customer with no history is not automatically fraud either. Neither is a large order, if the email, device, and payment history all line up. Killing those orders costs you revenue and reputation, which is why single-rule declines age badly.
Score, don't rule
Build a weighted list, define a threshold, and review everything that lands in the middle band by hand. Track which indicators actually preceded your chargebacks, not which ones feel suspicious. A signal that never appears in your confirmed fraud cases is just a false positive generator, and every false positive trains your team to ignore the alerts that matter.