CVV Test Script: What It Is and How to Stop Card Testing

A CVV test script is a program that sends card numbers to a payment page to learn which ones get approved. Criminals use it to check stolen card data before selling those numbers or running them at scale. The technique is called card testing, and it is a federal crime in the United States under 18 U.S.C. § 1029.

How does a CVV test script work?

The script automates the checkout step on a payment form. It submits a card number, an expiration date, and a security code, then records what the gateway sends back.

An approved response marks a card as live. A declined response gets dumped or sold as dead data. One run can push thousands of attempts through a store's checkout in a few minutes.

Most scripts aim at small stores with weak controls. Those sites lack rate limits, CAPTCHA, or address verification, so the requests pass with little friction.

Why criminals test cards at all

Card data leaks in bulk, and much of it is stale. A batch of 10,000 numbers may hold only a few hundred live cards. Testing separates the live ones from the dead ones before anyone pays for the data.

Testing also shows whether a card has a working CVV. Some issuers decline when the security code is missing or wrong, which tells the attacker that the card record is incomplete.

Why small charges appear in the logs

Testers submit tiny amounts, sometimes under a dollar, to lower the odds of tripping a fraud alert. The charge itself matters less than the approval code that comes back.

What are the warning signs of card testing?

• A sudden jump in declined transactions on one payment page.
• Dozens or hundreds of orders from a single IP address or device fingerprint.
• Many small orders placed within seconds of each other.
• Billing addresses that do not match the cardholder's location.
• Orders shipped to a small set of addresses across many card numbers.
• Cardholders calling to dispute charges they never made.

One or two signals may mean nothing. Three or more in the same hour almost always point to an active attack.

How does card testing cost a merchant money?

Every fraudulent charge that sticks becomes a chargeback. The card networks charge a fee per dispute, and the store also loses the goods and the processing cost.

Repeated attacks push a business into a card network monitoring program. Visa and Mastercard both run programs that fine acquirers when a merchant's fraud ratio stays high.

Long-running problems lead to higher processing rates or loss of the merchant account. That outcome ends online sales for most small businesses.

Who gets targeted by card testing scripts?

Attackers pick stores that sell digital goods or low-price items, because those orders complete with no shipping delay. Donation pages show up in reports for the same reason: a small gift is a cheap way to test a card.

Big retailers have fraud teams and models tuned to catch this traffic. Small shops on hosted platforms rely on default settings, which stop most bots but not a script built for the job.

How do you stop a card testing attack?

The fix is layered. No single control blocks every script, but a few together make a store an expensive target.

1. Require the CVV and the billing ZIP code on every checkout. Most scripts carry card numbers without matching address data.
2. Add rate limits per IP address, per card, and per email. Block a source after a set number of failed attempts.
3. Put a CAPTCHA or a bot-detection layer in front of the payment form.
4. Turn on 3-D Secure for card-not-present orders. Authentication shifts fraud liability to the issuer.
5. Set velocity rules in your gateway. Flag any card used more than twice in an hour.
6. Track declined-transaction volume as a fraud metric, not just approved orders.
7. Never store the CVV after authorization. PCI DSS Requirement 3.2 forbids it.

What if the attack is already running?

1. Block the offending IP ranges at the firewall, CDN, or hosting panel.
2. Pause card-not-present checkout until the traffic drops.
3. Refund every unauthorized charge and log the incident for your acquirer.

How do card networks and issuers spot testing?

Issuers see a burst of authorization requests against many of their cards from one merchant in a short window. That pattern looks nothing like normal shopping.

Visa and Mastercard share that signal with acquirers, who pass it to merchants. A store that ignores the warning can face fines or lose the right to accept cards.

Is it legal to buy or sell CVV data?

No. Buying, selling, or holding stolen card data violates 18 U.S.C. § 1029, with penalties of up to 10 years for a first offense and 15 years for repeat offenses. Similar laws apply in the UK, Canada, and across the EU.

Running a test script against a payment page can also trigger computer fraud charges under 18 U.S.C. § 1030. Merchants who process stolen cards on purpose carry their own liability.

FAQ

What does CVV stand for?

Card Verification Value. It is the three-digit code on the back of Visa, Mastercard, and Discover cards, and the four-digit code on the front of American Express cards.

Can a CVV test script prove a card is valid?

It can show that an issuer approved one authorization request. It cannot confirm that the card belongs to the person using it, and one approval does not guarantee that later charges will clear.

Do payment processors allow CVV storage?

No. PCI DSS bans storing the CVV after an authorization, even in encrypted form. Keeping it invites fines and a compromised merchant account.

What is the difference between card testing and carding?

Card testing is the verification step, where a script checks which numbers still work. Carding is the wider crime of using stolen card data to buy goods or move money.

What should a store owner do after an attack?

Refund the fraudulent charges, report the incident to the acquirer, and tighten checkout controls before the next wave starts.