How CVV checker fraud works
A CVV checker is a script that sends card numbers to a live payment gateway and reads the authorization reply. The reply shows if the card is open, if the CVV matches, and if the address check passed. The operator keeps the cards that pass and discards the rest. This is card testing. The charge is small, under $2 in many cases, because low amounts clear more often than large ones.
What the authorization reply contains
An authorization request carries the card number, expiry date, amount, and the CVV2 code printed on the card. The issuer answers with a response code. Three outcomes matter to a checker: CVV match, CVV mismatch, and not processed. Not processed means the issuer does not support the check or the field was empty. A mismatch does not block the sale in every case. Some issuers approve the charge and flag it after the fact, which is why testers log the code and not just the approval.
BIN data and why testers sort by it
The first six to eight digits of a card number form the BIN. The BIN points to the issuing bank and the card product. Testers group attempts by BIN because approval rates differ by issuer and by country. A batch that fails on one BIN may pass on another.
Why is CVV Checker Fraud Illegal
Signals a merchant sees
- Many card numbers from one IP address or device in a short window.
- Repeated amounts at or below $1.
- Decline rates above the site baseline.
- Cards from countries the merchant does not ship to.
- New accounts that place an order within minutes of signup.
What a CVV check cannot confirm
The check does not prove the holder authorized the charge. It confirms the data matches what the issuer has on file. A stolen card with the printed CVV and a matching ZIP will pass. 3-D Secure changes this. When the issuer asks for a one-time code or a banking app approval, a script cannot answer, so the attempt fails at that step.
What Is CVV Checker Fraud? Card Testing Explained for Merchants
Controls that stop card testing
Rate limits per IP and per card fingerprint cut volume. Velocity rules on the number of declines per session catch the pattern. Address verification and CVV requirements raise the failure rate for testers who hold nothing but a number. Blocking authorization attempts below a set amount removes the cheapest test path. Report failed attempts to the acquirer and monitor for bursts. Each attempt carries an interchange and gateway fee even when it fails.