CVV fraud rules at a glance

CVV fraud rules are the verification and liability standards that card issuers, card networks, and payment processors apply to card-not-present transactions. A CVV check compares the printed code on a card against the value the issuer holds on file. When the values differ, the issuer returns a no-match response, and the merchant is expected to decline the order. If the merchant submits the transaction anyway and the cardholder disputes it, the merchant carries the loss. The rules also forbid storing the code after authorization.

cvv fraud rules vs

The three verification values

  • CVV2, CVC2, or CID: the printed code used for online and phone orders.
  • CVV or CVC1: the value encoded on the magnetic stripe, read when a card is swiped.
  • iCVV: the chip-generated value used in EMV transactions, which changes with each transaction.

Networks treat these values as sensitive authentication data. They may travel with an authorization request but may not be kept afterward.

CVV Fraud Rules: Everything You Need to Know

Issuer response codes

  1. Match. The code agrees with the issuer record and the check passes.
  2. No match. The code is wrong. Treat the order as high risk and decline it.
  3. Not processed. The issuer did not run the check, often because enrollment is missing.
  4. Not supported. The card brand or issuer does not offer the check on that channel.

Not processed and not supported are not passes. A merchant that treats them as passes accepts risk with no verification behind it.

more on this topic

Configuring CVV rules on a payment account

  1. Confirm which verification fields your gateway can transmit for each card brand.
  2. Enable CVV2 and address verification for every card-not-present channel.
  3. Map the no-match response to an automatic decline.
  4. Send not-processed and not-supported responses to manual review.
  5. Record the response code on the order so disputes can be answered with evidence.
  6. Review decline and chargeback reports each month and adjust thresholds.

Liability and chargeback rules

Card network rules assign liability based on what was verified and how the transaction was captured. A card-present chip transaction with a valid iCVV shifts most counterfeit liability to the issuer. A keyed transaction without a CVV2 match leaves the merchant exposed. Chargeback reason codes for fraud and for no authorization both apply when a merchant processes an order after a failed verification. Processors track these ratios and can raise fees, hold funds, or close an account when fraud ratios pass network thresholds.

cvv fraud rules vs

What PCI DSS requires

The PCI Data Security Standard classifies the CVV, the full magnetic stripe, and the PIN block as sensitive authentication data. Merchants may not store any of it after authorization, even in encrypted form. Systems that touch the code must be segmented from the rest of the network, and logs must not capture the value. Validation of these controls falls under a self-assessment or an on-site assessment, depending on transaction volume.

Detection signals that support the rules

  • Velocity: many orders from one device, IP address, or card range in a short window.
  • Mismatch patterns: repeated no-match responses from the same BIN range.
  • Shipping and billing gaps: high-value goods sent far from the cardholder address.
  • Contact reuse: one email or device record tied to many card numbers.

Reporting suspected fraud

Merchants should report card fraud attempts to their acquiring bank and to the fraud contact at the card brand. In the United States, identity theft tied to payment cards can also be reported to the Federal Trade Commission. A record of declined orders and their response codes helps the acquirer and law enforcement trace a pattern.