CVV Fraud Detection Techniques: A Merchant Buying Guide
How to evaluate CVV fraud detection tools: verification layers, signal quality, latency and false positive benchmarks, plus pitfalls to avoid.
Redeem your gift cards at any of our Merchants
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Requiring the card verification value (CVV) on every card-not-present order, then backing it with address verification and a velocity rule, blocks more stolen-card fraud than any single tool you can buy. The controls below are ranked on three things: how much fraud they stop, how many legitimate orders they reject, and how fast a small team can switch them on without new engineering work.
Fraudsters who trade card data often hold the account number, the expiry date, and sometimes the cardholder name. What they frequently lack is the three or four digit code printed on the physical card, the billing address the issuer has on file, and a device history that matches the account. Detection is mostly a matter of asking for those details and paying attention when the answers disagree with each other.
Never let an order through when the CVC field is blank or when the issuer declines the code. This one step removes a large share of raw card-number testing, because a dumped number without the printed code fails the check.
Use it when: you sell physical goods to new customers. It is the first control to turn on and the cheapest to keep.
Address Verification Service returns match, partial match, or no match on the street number and ZIP. A full mismatch on a first order is a strong warning sign, especially on high-value baskets.
Use it when: you ship to a domestic address book. Treat full mismatches as declines and partial mismatches as review, not as automatic rejections.
Fraud rarely arrives as one order. It arrives as a burst. Count attempts per card number, per device fingerprint, per IP, and per email address over rolling windows, then flag anything that jumps.
Use it when: you sell anything with instant delivery or a short fulfillment window.
Step-up authentication shifts liability for eligible chargebacks to the issuer and forces the real cardholder into the flow. Apply it selectively rather than to every order.
Use it when: the basket is well above your average order value, the customer is new, or the AVS result is partial.
Look at combinations, not single fields. A billing address in one country, an IP in another, and a shipping address in a third is a pattern worth pausing. So is a brand new email address buying three items at the top of your price range, or five different card numbers sharing one device fingerprint.
Write down your triggers and keep the list short. Workable starting set:
Review within hours, not days. Card-not-present fraud windows close once goods ship.
Void or recall the shipment if you still can. Refund and block the card, device, email, and address. Keep the order records and the delivery data, because you will need them if the customer files a dispute. Report the incident to your acquirer so the pattern is on file.
A small shop should run CVC, AVS, and one velocity rule. A subscription business should authenticate at signup, then rely on tokens and a recurring-transaction rule set. A high-ticket retailer should add 3-D Secure and a staffed review queue. Layer the controls, watch your false-positive rate, and adjust thresholds as real order data comes in.