Start here: the one decision that matters
Buy fraud prevention that blocks a card testing run at the authorization request, not one that reports on it the next morning. Every other feature is secondary. Card testing works by volume: an attacker pushes thousands of low-value attempts through a payment page in minutes, keeping each one small enough to slip under a manual review queue. If your tool only scores transactions after settlement, the attacker has already confirmed which card numbers are live and your decline rate has already spiked. When you compare vendors, ask one question first: at what point in the transaction does the decision happen, and how fast is the response? Anything measured in hours is a reporting product, not a prevention product.
cvv fraud prevention compared to
What the product has to cover
CVV fraud prevention is not a single control. It is a stack of checks that each catch a different attack pattern. A vendor that sells only one of them will leave the rest of your exposure open.
cvv fraud prevention compared to
- CVV and AVS verification handling. The tool must read the CVV response code and the address verification result separately, and let you define what happens on a mismatch, a not-applicable response, and an unsupported card.
- Velocity and pattern limits. Counts per card, per IP, per device, per email, per shipping address, and per time window. Card testing shows up as many distinct card numbers from one device or subnet.
- Device and browser signals. Fingerprinting, proxy and VPN detection, and headless browser indicators, because most enumeration runs come from scripted clients.
- Authentication support. The ability to trigger 3D Secure on high-risk attempts and to route around it on low-risk ones, with the liability shift applied correctly.
- Case management. A queue your team can work, with reason codes and the ability to feed a confirmed fraud back into the model.
What to look for in a vendor
- Decision latency stated as a percentile, not an average. Ask for the 99th percentile figure.
- An explicit list of the data fields the service stores and for how long. Sensitive authentication data should not be retained after authorization under any circumstance.
- Rule changes you can make yourself, without a support ticket and a release cycle.
- Access to the raw signal behind a decline, so you can tell a true positive from a false one.
- Contract terms that let you leave without a multi-year lock-in if the decline rate on good customers climbs.
Thresholds and parameter bands
Most merchants set these too loose at launch and tighten them only after a chargeback spike. Treat the first ninety days as a tuning period and review the numbers weekly.
- Attempts per card per hour: a low single digit is normal for a genuine shopper; consistent retries across different cards from one source is the signal that matters.
- Distinct cards per device per day: keep this in the low single digits. Legitimate shared devices such as family tablets rarely exceed it.
- Order value band: flag attempts well below your average order value. Testers use small amounts to reduce their own cost of discovery.
- Manual review share: hold it under a few percent of total volume. Above that, you are paying staff to review real customers.
- False decline tolerance: set a target and measure it. A rule that stops fraud but rejects one in twenty paying customers is usually a net loss.
Pitfalls that show up after you sign
- Onboarding that takes weeks. Attackers do not wait, and neither should your integration.
- Opaque scoring. If the vendor cannot explain why a transaction was declined, you cannot defend the decision to a customer or a chargeback analyst.
- Rules that only fire on new customers. Account takeover on returning customers is a separate pattern and needs its own coverage.
- No feedback loop. A model that never learns from your confirmed fraud cases decays within months.
- Ignoring the acquirer side. Card network monitoring programs penalize acquirers for excessive fraud and dispute ratios, so your processor may have its own thresholds you need to stay under.
FAQ
Is CVV verification enough on its own?
No. It confirms the cardholder supplied the printed value, but a stolen card with the CVV included defeats it. Pair it with velocity limits, device signals, and authentication on high-risk attempts.
CVV Fraud Prevention Compared to Traditional Methods
How quickly should a prevention tool respond?
The decision belongs inside the authorization flow, before the response is returned. Milliseconds at the 99th percentile is the practical target.
What should I measure after launch?
Track your false decline rate, your card testing attempt count, your manual review share, and your dispute ratio. If any of the four drifts, revisit your thresholds.
Can I store CVV data to check it later?
No. Sensitive authentication data must not be retained after authorization, even in encrypted form. Validate it in flight and discard it.