Short answer

There is no legitimate tool, script, or checklist that tests whether a Visa CVV is valid. The three or four digit code on a Visa card is checked only by the issuing bank, and only inside a real authorization request sent through a payment processor. Any service that advertises "CVV testing" is either selling stolen card data or running a card-testing fraud operation, and using one is a federal crime in the United States.

cvv test visa best

What people mean by "CVV test"

Most searches for CVV testing come from two places: merchants who want to confirm their checkout validates the code correctly, and fraud operators who want to check stolen numbers at scale before reselling them. The second use case is why the phrase has a bad reputation. Card testing, sometimes called card checking, sends small authorization attempts against a payment gateway to see which numbers are live. The gateway sees the traffic, the issuer sees the traffic, and both keep records.

cvv test visa alternative

The CVV exists to prove the physical card is present or the cardholder knows the printed code. It is not a password, it is not a lookup key, and it cannot be validated outside an authorization message. A number that "passes" a test on some third-party site has simply been transmitted to someone who now has it.

read more

Signals that a merchant is being card tested

  1. A burst of declined authorization attempts from the same IP range in a short window.
  2. Many different card numbers used against one customer account or one email address.
  3. Order values that stay small, often under a few dollars, across dozens of attempts.
  4. A high ratio of declines to approvals on a single checkout page.
  5. Billing addresses and card BINs that do not match the shipping country.

How to stop it

  1. Make CVV and AVS checks required fields in the gateway rather than optional.
  2. Set velocity limits per IP, per card BIN, and per customer account.
  3. Block or challenge traffic from hosting providers and known proxy ranges.
  4. Enable 3-D Secure on high-risk transactions so the issuer authenticates the cardholder.
  5. Review chargeback ratios weekly and file fraud reports with your acquirer.

If your own card was tested

  1. Call the number on the back of the card and ask for a replacement.
  2. Dispute any charge you do not recognize in writing.
  3. Report the incident at IdentityTheft.gov and to the FTC.

Legal ways to verify card details

  • Run a zero-dollar or one-dollar authorization through your own payment processor with the cardholder present.
  • Use the processor's sandbox with the test card numbers it publishes, never real card data.
  • Ask the customer to re-enter the code on a secure hosted payment page you control.

Keeping a CVV after authorization is prohibited by PCI DSS, so any database or spreadsheet of CVV values is out of scope for a compliant business and becomes evidence in a fraud case.

cvv test visa best