CVV fraud guidelines are the rules and practices that stop someone from using a card verification value without the cardholder's permission. They cover what merchants may store, when to ask for the code, how to spot abuse, and what cardholders should do to keep the three- or four-digit code private. The short version: require CVV for card-not-present sales, never store it after authorization, and treat repeated CVV failures as a fraud signal.

cvv fraud regulations

What the CVV is and why fraud teams watch it

The CVV is the code printed on a card: three digits on the back for most cards, four on the front for American Express. It is not the same as the card number or the PIN. In a card-not-present sale, the CVV helps show that the buyer has the physical card. It is one layer of proof, not a guarantee. A stolen card number can circulate without the CVV, so a failed CVV check is often the first clear sign of a carding attempt.

CVV Fraud Control Measures That Actually Work

Merchant guidelines

When I review a checkout flow, I look for three things: whether CVV is required, whether it is stored anywhere, and whether failed attempts trigger a manual review. A merchant that gets those three right removes most of the easy fraud paths.

read more

  • Ask for the CVV on every card-not-present order. Do not let customers skip it because they are in a hurry.
  • Never store the CVV after authorization. PCI DSS treats it as sensitive authentication data. Keeping it in a database, a spreadsheet, or an email inbox creates a breach risk and a compliance problem.
  • Use tokenization for repeat customers so the real card data does not sit in your system.
  • Check the billing address with AVS and consider 3-D Secure for high-risk orders. These checks work better together than alone.
  • Set rules for velocity, repeated CVV failures, and mismatched country data. A single failure may be a typo. Five failures from one device in ten minutes is not.
  • Train phone and chat staff to never write down a CVV or read it back. If a customer offers the code in an email, do not use it.
  • Keep checkout pages on PCI-compliant systems and patch them. A skimmer that captures CVV data can turn a small site into a fraud source.

Cardholder guidelines

Cardholders have less control than merchants, but a few habits cut the risk.

cvv fraud policy

  • Cover the code when you hand over the card. Treat it like the card number.
  • Do not give the CVV to anyone who calls, texts, or emails you. A real issuer will not ask for it.
  • Use virtual cards or mobile wallets for online purchases when your bank offers them.
  • Review statements and turn on transaction alerts. Small test charges often come before a large one.
  • Report a lost card or a strange charge right away. Your liability protection depends on prompt notice.

Red flags of CVV fraud

  • Several failed CVV attempts from one IP address or device.
  • A billing address that does not match the card's country or BIN range.
  • A large order with expedited shipping from a new account.
  • Multiple cards tried in a short window on the same order.
  • A customer who asks to bypass CVV or sends the code in an email or chat.
  • Orders that ship to a freight forwarder or an address that has no relation to the cardholder.

Compliance and legal basics

PCI DSS requires merchants to protect sensitive authentication data, including the CVV, and prohibits storing it after authorization. Buying or selling CVV data is illegal in the US and most countries. It falls under fraud and identity theft statutes, and card networks can impose fines and chargeback liability. A merchant that skips CVV or 3-D Secure can lose a chargeback dispute even when the order looked normal.

What to do if you suspect CVV fraud

  1. Freeze the card through the issuer's app or phone line.
  2. Contact the card issuer and report the suspected fraud.
  3. File a report with local police or the FTC if identity theft is involved.
  4. Keep order logs, IP addresses, and failed CVV records for the processor.
  5. Review checkout rules for gaps in CVV, AVS, and 3-D Secure.

Good CVV guidelines are simple: collect the code when it helps, protect it when you have it, and never treat it as data you can keep. That approach lowers fraud, supports compliance, and gives cardholders a fair shot at catching misuse early.