CVV Attack IOC Guide: Detect Card Testing & Brute Force

What Is a CVV Attack IOC?

A CVV attack indicator of compromise (IOC) is an observable artifact or pattern that suggests an attacker is attempting to validate stolen card numbers by brute-forcing the card verification value (CVV). These attacks often appear as card testing or carding activity. Unlike a single fraudulent transaction, a CVV attack generates a high volume of authorization requests with varying CVV codes against one or many card numbers. Security teams use IOCs to detect, block, and investigate such attacks before they lead to chargebacks or data breaches.

Prerequisites for Investigating CVV Attack IOCs

• Access to payment gateway logs or authorization logs.
• Ability to query transaction data by IP address, card BIN, and timestamp.
• Baseline of normal authorization failure rates for your merchant account.
• Contact information for your acquiring bank's fraud department.

Common IOCs for CVV Attacks

Watch for these patterns in your transaction data.

• Spike in authorization failures with response code 05 (do not honor) or CVV mismatch codes.
• Multiple card numbers sharing the same IP address or device fingerprint within a short time window.
• Sequential or near-sequential card numbers attempted from one source.
• Small transaction amounts (often under $1) used to test card validity.
• High velocity of attempts per card, such as 10 or more CVV tries in one minute.
• Geographic mismatch between the card's issuing bank country and the IP address location.
• Use of disposable email domains or generated usernames at checkout.

How to Investigate a Suspected CVV Attack

1. Pull all authorization records from the last 24 hours that have a CVV mismatch or decline response.
2. Group those records by IP address and count the number of unique card numbers per IP.
3. Flag any IP address that has attempted more than five unique card numbers in one hour.
4. Check the flagged IP addresses against threat intelligence feeds for known carding activity.
5. Review the user agent strings for automation tools or headless browsers.
6. Identify the merchant account or payment page that generated the attempts.
7. Document the time range, IP addresses, and card BINs involved.
8. Report the findings to your acquiring bank and request a block on the offending IPs.

Response Actions After Confirming a CVV Attack

1. Enable rate limiting on your payment endpoint to cap attempts per IP per minute.
2. Add the offending IP addresses to your web application firewall (WAF) blocklist.
3. Require CAPTCHA or 3D Secure for transactions that exceed a risk score threshold.
4. Notify affected card issuers if you have a direct relationship, or let your acquirer handle it.
5. Preserve all logs for at least 90 days for potential law enforcement review.

CVV attacks succeed when detection is slow. Monitor failure rates daily and treat any sudden change as a potential IOC.