CVV Checker Fraud: How to Avoid It When Selling CVVs Online
Learn how to stay safe and avoid becoming a victim of CVV checker fraud when selling CVVs online.
CVV Test AVS: How Card Testing Appears in Authorization Data
Short answer
A CVV test is an authorization attempt that checks if a card number, expiration date, and security code work together. AVS is a second check in the same request. It compares the billing address on the order with the address the issuer has on file. AVS returns a letter code. CVV returns a letter code. The two answer different questions.
What AVS returns
- Y: street number and ZIP both match.
- A: street matches, ZIP does not.
- Z: ZIP matches, street does not.
- N: neither matches.
- U: address data is unavailable.
- G: card is not from the US or Canada, so AVS does not apply.
AVS reads the numeric part of the street address and the ZIP code. It does not read apartment numbers or city names. Issuers outside the US and Canada often do not support the check, so G and U responses are normal for those cards.
What CVV returns
- M: security code matches.
- N: security code does not match.
- P: code was not processed.
- U: issuer cannot check the code.
- S: code should have been on the card but was not sent.
Online orders use the printed code on the back of the card, or the four digits on the front of an American Express card. The magnetic stripe and the chip hold a different value. PCI DSS requirement 3.2 forbids storing the code after authorization. A merchant that keeps it fails the audit.
How test runs look in the data
Card testing shows up as a burst of low-dollar authorizations. Amounts sit between $0.01 and $2.00. One device or IP address sends dozens of attempts in a few minutes. Approval rates fall near zero. A wide spread of BINs points to a test run, not to shoppers.
AVS and CVV both help spot this pattern, but neither stops it. A decline on AVS code N or CVV code N means the submitted data does not match the issuer record. Rate limits, device fingerprints, and velocity rules catch the rest.
Legal status
Buying, selling, or using a card number that belongs to another person is fraud. In the US, 18 U.S.C. 1029 covers access device fraud. Convictions carry fines and prison time. Issuers, processors, and card networks report card testing to law enforcement.