Short answer
A CVV test app is software that sends card numbers with their CVV codes to a payment gateway and records which ones return an approval. The operator uses the result to sort stolen card data into working and dead sets. The app does not verify that the user owns the card. It tests whether a bank will authorize a charge.
What the app does
Most versions run a small charge, often under $1, then void it when the gateway allows a void. Some use an address verification check instead of a charge. The app logs the response code from the issuer. Codes differ by gateway: approved, declined, CVV mismatch, do not honor. A seller reads those codes as a quality signal on a batch of card data.
Volume matters. A test app sends many requests in a short window, from a rotating set of IP addresses and merchant accounts. The goal is to stay under fraud limits at each merchant.
Why the term appears in carding markets
Sellers of stolen card data use CVV test app as a product label. The claim is that the app proves a card is live before a buyer pays for it. Buyers treat a test result as a warranty. In practice, a test result from one merchant does not carry to another merchant, and a card that approves a $1 charge can decline a $500 charge.
Legal status in the US
Use of a CVV test app on cards the operator does not own is access device fraud under 18 U.S.C. § 1029 and can also support wire fraud and identity theft charges. Possession of tools to test card data can be used as evidence of intent. Selling card data is a separate federal crime.
Why the tests fail
- CVV results are per issuer and per card. A match on one gateway does not mean a match on another.
- Issuers limit repeated authorization attempts and flag patterns across merchants.
- PCI DSS forbids merchants from storing the CVV after authorization, so a test that relies on stored CVV data is already outside card network rules.
- Card networks score merchants on authorization and chargeback rates. A merchant account used for testing gets closed.
What a real verification looks like
Legitimate businesses verify a card through the card network. They use 3-D Secure, address verification, and CVV checks at the point of sale. They do not test stolen data. The CVV is not stored.
If a card is charged
A cardholder who sees an unknown small charge should contact the issuer and dispute the charge. The issuer can close the card and issue a new number.