How to Defend Against a CVV Attack: Merchant Guide

The strongest defense against a CVV attack is a layered one: require CVV verification on every card-not-present authorization, cap attempts per card, IP, and BIN, then route suspicious traffic into a 3-D Secure challenge. Those three controls cover the most ground for the least engineering time, and they hold up whether an attacker is hammering a single card or spraying thousands of numbers from a botnet. Each control below is judged on four criteria: how fast you can turn it on, how many legitimate customers it turns away, how well it survives attacker rotation of IPs and BINs, and whether it helps you win a chargeback dispute.

What a CVV attack actually is

A CVV attack is card testing aimed at the three or four digit verification value. The attacker has a card number, often from a breach dump, and needs the CVV to make the card usable. So they submit small transactions, usually a dollar or less, against a checkout form and watch which ones authorize. Every approval confirms a valid card and a valid CVV together. Merchants see the damage later as a wall of chargebacks, issuer fines, and a spike in decline rates that can trip a processor's fraud threshold.

The tell is in the pattern, not in any single order: hundreds of attempts in minutes, sequential or generated card numbers, mismatched country of IP and billing address, and a flood of tiny baskets from first-time visitors.

1. Require CVV on every authorization

This is the baseline. Set your gateway to require the CVV match response, and configure your rules so a failed CVV check declines rather than warns. If your processor returns a mismatch code, use it as a hard decline on first orders.

Pros

• Turns on in minutes in most gateway dashboards, with no code change.
• Defeats blind guessing, which is how most enumeration scripts work.
• A CVV match gives you a documented defense when you contest a chargeback.

Cons

• Does nothing if the attacker already holds the full card record, including the CVV.
• Typing errors on legit orders cause false declines, especially on mobile keypads.
• Not every issuer returns a CVV result in every market.

Best for: every merchant with a public checkout. This should never be optional.

2. Cap attempt velocity by card, IP, email, and BIN

Velocity rules are what stop an attack in progress. Set hard ceilings over short windows: no more than three authorization attempts per card number per hour, no more than ten per IP per hour, and a daily cap per BIN range. Block disposable email domains at the form level and require the email to match the pattern of a real inbox.

Pros

• Catches enumeration in the first minute, before approvals pile up.
• Cheap to implement in gateway rules or in your own middleware.
• Also slows friendly fraud and account takeover attempts.

Cons

• Shared IPs at offices, schools, and mobile carriers can trigger false blocks.
• Skilled attackers rotate residential proxies and spread attempts across many BINs.
• Thresholds need tuning after every product launch or promotion.

Best for: digital goods, gift cards, donations, and any store with instant delivery, where a stolen card converts to value in seconds.

3. Turn on AVS and require a postal code match

Address Verification Service compares the numeric part of the billing street address and the ZIP code against what the issuer holds. Pairing AVS with CVV raises the bar, because an attacker who guessed a CVV still has to produce a matching address.

Pros

• Strong signal on card-not-present orders with no added friction for most buyers.
• Widely supported by US issuers.
• Easy to combine with velocity rules into a single decline policy.

Cons

• Coverage and response codes vary outside the US, so strict rules hurt international sales.
• Customers who moved recently or use a business address often fail the check.
• AVS alone will not stop a full card record dump.

Best for: physical goods merchants shipping to a billing address, and any store where the shipping destination can be independently verified.

4. Use 3-D Secure step-up on risky traffic

Instead of challenging everyone, send only the risky sessions to 3-D Secure: new device, mismatched geography, high basket value, or a card seen once. The issuer then authenticates the cardholder in an app or with a one-time code.

Pros

• Stops automated testing outright, because a script cannot complete an authentication challenge.
• Liability shift on authenticated transactions moves fraud chargebacks to the issuer.
• Selective use keeps friction off your best customers.

Cons

• Adds cost per challenged transaction and can reduce completion rates.
• Requires engineering work to define the risk triggers.
• Some issuers still do not support authentication in every region.

Best for: high-ticket sellers, subscription businesses with trial abuse, and any merchant already above its processor's fraud ratio threshold.

5. Monitor the signals and keep a response runbook

Controls fail quietly. Watch authorization counts per minute, approval rates by BIN, the share of orders under two dollars, and the ratio of new customers to returning ones. Write down who gets paged, how to disable a payment method, and how to contact your acquirer when an attack starts.

Pros

• Catches attacks that slip past static rules.
• Gives you evidence for issuer disputes and processor reviews.
• Shortens the window between first attempt and containment.

Cons

• Needs an owner and periodic threshold review.
• Alert fatigue is real if you page on every decline spike.

Best for: every merchant processing more than a few hundred orders a month.

What not to do

1. Never store the CVV, the full track data, or the PIN block after authorization. PCI DSS prohibits retaining sensitive authentication data, and storing it turns a fraud incident into a compliance incident.
2. Do not disable CVV checks to lift conversion. The short-term gain is smaller than the chargeback bill.
3. Do not rely on a single control. Attackers adapt to one rule; they rarely defeat three at once.
4. Do not treat a small-dollar approval as harmless. That approval is the attacker confirming a card, and it will be followed by a large one.

Putting it together

Start with CVV enforcement today, since it costs nothing and closes the easiest path. Add velocity caps this week, then AVS, then selective 3-D Secure for the sessions your rules flag. Track your decline rate and your fraud ratio for two weeks after each change, and loosen any rule that costs you more good orders than bad ones. The goal is not a perfect filter. It is making your checkout the least attractive target on the attacker's list.