Choose from any of our gift cards to give to your loved ones
CVV Fraud Detection Tips: A Practical Merchant Guide
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Buy a fraud stack that verifies the card verification value at authorization, scores the session with device and behavioral signals, and watches for card testing after the fact. Those three layers cover most card-not-present loss, and any vendor that only sells you one of them will leave a gap. Judge tools on measured performance at your own traffic mix: detection rate at a fixed false positive rate, decision latency, and how clearly the system explains why it blocked a transaction. Feature lists are cheap. Precision is not.
The CVV check only works when you send it to the issuer as part of the authorization request. A mismatch means the number and the verification value did not come from the same physical card. Look for a gateway or processor that returns the verification response code alongside the authorization result so your rules can act on it in the same request. If the tool can only check the value after you have already approved the order, you are buying a reconciliation report, not a control.
Ask what data the vendor actually contributes. Useful inputs include device fingerprint stability across accounts, email and phone reputation, IP geolocation against billing address, shipping and billing mismatch history, velocity across merchant networks, and historical chargeback outcomes tied to the card fingerprint. A model trained on one merchant's data will underperform on yours. Shared consortium data usually beats a solo model, provided the vendor can show how the shared labels are cleaned.
Your analysts need reason codes they can read. A score of 87 with no drivers forces manual review of everything or blind trust of everything. Look for rule and model reason codes, the ability to write your own rules on top of vendor signals, and a queue that supports bulk decisions. If the vendor cannot show you the review interface during evaluation, treat that as a gap.
Storing the verification value after authorization is the mistake that turns a fraud problem into a compliance problem. It is prohibited under the card data security standard, and a vendor that offers to keep it for you is not a vendor worth keeping. The second common error is leaning on address verification alone. Address checks fail on legitimate customers who moved recently and pass on fraudsters who have the full profile. Third, ignore card testing at your peril: small trial charges, often under a dollar, precede larger fraud runs and show up as velocity spikes on a single card fingerprint or device. Fourth, models decay. Fraud patterns shift within weeks, so ask how often the vendor retrains and whether you get model version history. Fifth, avoid a vendor that cannot produce a service organization control report or a penetration test summary. You are trusting them with cardholder data.
No. They stop fraud where the attacker has the card number but not the printed value, which is a large share of database dumps but not all of it. Skimming and phishing that capture the full card face defeat the check.
You may store the authorization response, not the value. Sensitive authentication data must not be retained after the transaction completes.
Run a silent pilot on live traffic where the vendor scores orders but you keep your existing decision logic. Compare detection at matched review rates over at least four weeks, then compare latency and analyst workload.
It is a run of low-value authorization attempts used to confirm which stolen numbers are live. Detect it with velocity limits per card fingerprint, device, and IP range, and by watching for spikes in declined attempts.
