CVV attack mitigation is the set of controls that stop automated attempts to guess or validate card verification values against your checkout. The core stack is rate limiting, per-card and per-IP velocity checks, CAPTCHA or proof-of-work on payment endpoints, strict AVS and CVV result handling, and 3-D Secure step-up for suspicious traffic. Mitigation works when these controls run together and every decline is logged, scored, and reviewed.
What is a CVV attack?
A CVV attack is a scripted attempt to confirm stolen card data by submitting card numbers with guessed three- or four-digit verification codes. Attackers usually pair the card number with a matching expiry and run thousands of low-value authorizations to find combinations that approve. The goal is validation, not merchandise, so the first successful charges are often small and fast.
How does a CVV attack differ from ordinary card fraud?
Ordinary fraud tries to extract goods or cash from one stolen card. A CVV attack is an enumeration and testing operation that touches many cards at once. That difference matters because per-transaction fraud rules rarely catch it, while traffic-shape rules usually do.
What are the warning signs of card testing on a checkout?
- A sudden spike in declined authorizations with a CVV mismatch reason code.
- Many card numbers tried from a small set of IP addresses, devices, or email domains.
- Bursts of low-value orders, often under a few dollars, placed within seconds of each other.
- Sequential or near-sequential card numbers sharing the same bank identification number range.
- Checkout completions that skip browsing behavior, cart building, or product page views.
- Disposable email addresses, mismatched billing and shipping countries, or free email domains paired with high-risk geographies.
Which controls actually stop a CVV attack?
- Rate limit the payment endpoint. Cap attempts per IP, per device fingerprint, per card BIN, and per session, and throttle rather than only blocking.
- Add challenge before authorization. Place CAPTCHA, proof-of-work, or bot detection in front of the submit action so scripts never reach the gateway.
- Enforce AVS and CVV result logic. Treat a CVV mismatch as a hard decline and never retry the same card with a different code.
- Step up to 3-D Secure. Route new devices, high-velocity sessions, and risky geographies to an authentication challenge instead of a silent authorization.
- Set velocity rules by BIN. Flag clusters of attempts across many cards sharing one issuing range, which is the signature of enumeration.
- Block known bad infrastructure. Use proxy and VPN detection, datacenter IP lists, and device reputation feeds rather than IP blocking alone.
- Alert in real time. Trigger a pager or chat alert on decline-rate spikes so response starts in minutes, not at the monthly review.
How should you respond when an attack is already running?
Raise the challenge threshold on the payment endpoint first, then enable 3-D Secure on all traffic until decline rates return to baseline. Pull the gateway logs and group attempts by IP, device, and BIN to find the pattern the attacker is reusing. Notify your acquirer and payment processor early, because excessive authorization attempts can trigger scheme monitoring and fee assessments.
What compliance rules shape CVV handling?
PCI DSS prohibits storing card verification values after authorization, so no mitigation plan should involve retaining CVV data for later comparison. Keep the verification code out of logs, error messages, and support tickets, and confirm your gateway tokenizes the card number before it reaches your systems. Retention of sensitive authentication data is a compliance failure, not a fraud control.
How do you measure whether mitigation is working?
Track the ratio of authorization attempts to completed orders, the share of declines with a CVV mismatch code, and the count of blocked sessions by rule. A healthy program shows a falling attempt-to-order ratio while legitimate conversion stays flat. Review these three metrics weekly, and re-tune thresholds after any change to checkout flow or payment provider.