CVV enumeration is the practice of guessing card verification values (3 digits on the back of Visa and Mastercard cards, 4 on American Express) by sending authorization requests to a live payment gateway until one approves. It is a form of card testing aimed at card numbers an attacker already holds. The method is loud, slow, and costly to run, which is why most attempts collapse inside a few hours.
How does CVV enumeration work?
Every attempt needs three things: a card number, a candidate code, and a live checkout that will process an authorization. Attackers script the third part and let it run at volume.
- Card numbers come from breaches, skimmers, or resold dumps.
- Requests go through checkout pages, donation forms, or gateway APIs.
- Ticket sizes stay small, often $0 to $1, to slip under fraud rules.
- Results get sorted into live and dead lists for resale.
The phrase "cvv enumerate" turns up in carding forums and in fraud analyst reports. Both use it for the same loop: guess, authorize, record, repeat.
Why does CVV enumeration fail most of the time?
Four controls stack against it, and each one gets stronger as volume rises.
Issuer retry limits
Issuers count CVV mismatches per card. After a small number of failed checks, the issuer can block further verification attempts on that account. A search space of 1,000 values cannot finish before the card locks.
Velocity and scoring at the gateway
Payment processors score every authorization on card velocity, IP reputation, device reuse, and decline history. A run of small declines from one source trips those rules fast.
Address verification (AVS)
AVS compares the billing street number and ZIP to issuer records. A guessed code does not come with a matching address, so even an approved auth fails the next check.
3D Secure challenges
3DS pushes the cardholder to a bank prompt. Bots cannot pass that step, so a merchant with 3DS on most traffic sees enumeration die at the challenge screen.
What does card testing look like in payment logs?
Enumeration leaves a pattern that stands out once you filter for it.
- Dozens of declines from one IP, device, or email in minutes.
- Authorization amounts under $1.00.
- Many card numbers inside one session or one customer record.
- Cardholder names that look random or repeat across cards.
- Spikes in CVV mismatch decline codes.
Pull the decline reason codes first. A cluster of CVV mismatch or invalid card responses from one source is the clearest signal.
How do merchants block enumeration attempts?
- Rate limit by IP, device, email, and card BIN.
- Require CVV and AVS on every authorization.
- Turn on 3D Secure for high-risk regions and new customers.
- Block disposable email domains and known proxy ranges at checkout.
- Watch decline ratios per source and auto-block past a threshold.
- Keep the payment page off limits to scrapers and bots.
Most gateways ship with these tools. The gap is often configuration, not capability.
What happens to a merchant hit by a testing run?
Even failed authorizations cost money. Each attempt adds a request fee, and a flood of declines can push a merchant into a card network fraud monitoring program.
- Authorization fees on thousands of tiny attempts.
- A decline ratio that drags approval rates down for real customers.
- Chargebacks when a guessed card approves and the holder disputes it.
- Possible placement in a card network fraud monitoring program.
Is CVV enumeration illegal?
Yes. In the US, prosecutors charge card testing under access device fraud (18 U.S.C. 1029) and wire fraud (18 U.S.C. 1343), and it can also fall under the Computer Fraud and Abuse Act. Card network rules treat it as fraud, and any merchant holding CVV data breaks PCI DSS Requirement 3.2, which bans retention of the code after authorization.
That last point matters for anyone who trades in card data. A CVV sitting in a database or a text file is out of compliance by definition, and no PCI DSS program can cover a CVV store.
Common questions about CVV enumeration
How is CVV enumeration different from a BIN attack?
A BIN attack guesses card numbers inside one issuer range. Enumeration guesses the code on numbers the attacker already has. Many campaigns mix both.
Can a CVV be guessed by luck?
A 3 digit code has 1,000 possible values and a 4 digit code has 10,000. Luck can hit once, but volume guessing trips issuer limits long before it turns a profit.
Why do some sites ask for the CVV again on later orders?
Because PCI DSS bars storage of the code after authorization. Merchants must collect it on each transaction, so even saved-card checkout still needs those digits.
Does a CVV match prove the buyer owns the card?
No. Skimmers and full dumps include the code. A CVV match combined with AVS and a 3DS pass is a stronger signal than any single check.