What CVV enumeration is
CVV enumeration is a brute-force attack on card verification values. The attacker holds a list of card numbers and submits each one with guessed CVV codes to a payment endpoint. The CVV is the 3-digit code printed on the back of Visa and Mastercard cards, or the 4-digit code printed on the front of American Express cards. Enumeration cycles through values until one is accepted.
The term also covers a second pattern: one card number submitted many times with different CVV values. Both patterns need a live authorization endpoint. Both leave a log trail.
What the three codes mean
- CVV1 is encoded on the magnetic stripe and read when a card is swiped at a terminal.
- CVV2 (CVC2, CID) is printed on the card surface and typed into online checkout forms.
- iCVV sits in the chip and uses a different calculation.
Online enumeration targets CVV2. PCI DSS forbids storing CVV2 after authorization, so a database breach does not hand over the printed code.
Why attackers try it
Card records from breaches often contain track data but not the printed code. A card number with no valid CVV2 fails at checkout on merchants that enforce the check. Enumeration is an attempt to fill that gap.
The math works against the attacker. A 3-digit code has 1,000 possible values. A blind guess succeeds 0.1% of the time.
Why it fails in practice
- Issuers cap verification attempts per card. Visa and Mastercard rules limit retries on a single card number.
- Declines carry reason codes. A CVV mismatch returns a response distinct from an insufficient-funds response, and the merchant plus the issuer see the same pattern.
- Fraud scoring models flag several authorization attempts on one card inside a short window.
- Velocity rules and BIN-level limits at the acquirer block the traffic before it reaches the issuer.
Detection signals
Acquirers and gateways watch for repeated authorization requests on the same card number, card-testing amounts under $2, many card numbers from one IP address, a country mismatch between IP address and BIN, and a high ratio of CVV mismatch declines. A merchant account that carries the traffic risks fines and closure under network rules.
Legal status in the US
CVV enumeration is charged under 18 U.S.C. § 1029, which covers unauthorized access devices and traffic in them. The Computer Fraud and Abuse Act applies when a protected system is reached without authorization. Card networks treat the activity as a fraud violation.
Terms used here
- BIN: the first 6 to 8 digits of a card number, which identify the issuing bank.
- AVS: Address Verification System, a separate check on billing street number and ZIP code.
- Card testing: small authorizations used to confirm that a card number is live.