CVV velocity checks are fraud controls that count how many times a card number, CVV entry, device, IP address, or customer identity appears in payment attempts over a set time window. When that count crosses a merchant-defined threshold, the system declines the transaction, requests 3D Secure authentication, or routes it to manual review. They are one of the main defenses against card testing, where stolen card data is validated through many small authorization attempts.
What does a CVV velocity check actually measure?
A CVV velocity check tracks repeated verification attempts against a specific card or account rather than a single transaction. Failed CVV mismatches are weighted more heavily than successful ones, because a burst of mismatches usually points to automated guessing. Systems also watch CVV attempts made from one device or IP across many different cards.
How do merchants set velocity thresholds?
Thresholds are layered across rolling windows such as one minute, one hour, 24 hours, and seven days. A common setup allows a small number of attempts per card per hour, a larger number per device per day, and a hard cap per IP per hour.
- Card level: attempts per hashed card number or BIN.
- Device level: attempts per device fingerprint or browser profile.
- Network level: attempts per IP address or subnet.
- Identity level: attempts per email, phone, or shipping address.
Why are velocity checks important for card testing?
Card testing attacks, sometimes called BIN attacks, submit large volumes of low-value authorizations to find which stolen card numbers are still active. Each attempt needs only a card number, expiry, and CVV, so the pattern shows up as abnormal authorization velocity before chargebacks appear. Velocity rules break that loop by cutting off the source after a few attempts.
What happens when a velocity rule fires?
Most risk engines respond with graduated actions. A first trigger might apply a soft decline and require 3D Secure, a second might hold the order for manual review, and repeated triggers can blocklist the card, device, or IP. None of these steps confirms fraud on its own, so teams combine them with AVS results, CVV match codes, and behavioral signals.
What causes false positives?
Legitimate customers can trip velocity rules through shared corporate networks, travel, new devices, or repeated subscription retries. Solid implementations tune thresholds against historical data and track the false positive rate next to the fraud capture rate. Limits set too tight reduce fraud but also cost genuine sales.
How do velocity checks differ from other fraud tools?
AVS and CVV checks evaluate the accuracy of data in a single transaction. Velocity checks evaluate patterns across many transactions. Machine learning risk scores blend both, using velocity as one input among dozens of others.