Choose from any of our gift cards to give to your loved ones
how to defend against cvv attack
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Most card verification value attacks are not clever. Someone points a script at your checkout, fires thousands of card numbers with guessed CVVs, and keeps whatever the issuer approves. From your side it looks like a burst of small orders and a wall of declines. The defense that holds is layered: rate limiting and velocity rules, bot detection on the payment endpoint, correct reading of CVV and AVS response codes, and 3-D Secure on traffic that looks wrong. No single control survives on its own.
Attackers rotate IPs, rent residential proxies, and spread attempts across hundreds of BINs so no single card gets hammered. Each request in isolation looks like a real customer buying something cheap. The signal lives in the aggregate: attempt volume per device, per email, per subnet, and the ratio of CVV mismatches to approvals over a short window.
This is the cheapest control and the one most merchants skip on the payment endpoint specifically. Your login page may be locked down while the authorization call sits wide open.
A CAPTCHA or invisible bot challenge in front of the payment step raises the cost of every attempt. Attackers measure success in attempts per hour, and friction that trims that number by 90 percent usually sends them elsewhere. Put the challenge on the checkout, not just the account page, and make sure it cannot be cached or replayed.
A CVV mismatch means the value did not match the issuer record. It does not, by itself, mean fraud. Plenty of honest customers mistype three digits, and some issuers return mismatches for legitimate cards. Combine CVV, AVS, and 3-D Secure results before you decide. A rising mismatch rate across many cards is the real alarm.
One rule has no exceptions: do not store the CVV. PCI DSS prohibits retaining sensitive authentication data after authorization, so if your logs or database capture it, that is a finding waiting to happen. Tokenize and move on.
Applied selectively, 3-D Secure cuts card testing and shifts liability on approved transactions. Running it on every order hurts conversion for your best customers. Running it on new devices, mismatched AVS, high-risk geographies, and first-time buyers gives you most of the protection with a fraction of the friction.
Set a baseline for approvals, declines, and CVV mismatches per hour. Alert when the mismatch rate doubles or when attempt volume jumps outside normal hours. Review blocked traffic weekly, because a rule that stopped an attack last month may now be turning away real buyers. Fraud defense is a tuning job, not a one-time setup.
