A CVV enumeration attack is a card-testing technique in which an attacker submits many card number and CVV combinations to a payment endpoint and looks for pairs that authorize. It depends on weak rate limiting, loose validation, and slow fraud detection rather than on stolen card data alone.
How a CVV enumeration attack works
The attacker starts with card numbers from a breach, a generator, or a purchased list. Because the CVV is only three or four digits, a checkout page that allows repeated attempts with no lockout gives the attacker a small search space. The attacker spreads attempts across many IP addresses, devices, and merchant accounts to avoid simple blocks.
Each attempt produces an authorization response. A decline for CVV mismatch tells the attacker the card number may still be live. A successful authorization confirms a usable card. Automated tools record the results and move to the next number. The goal is to find valid card and CVV pairs that can be used for purchases or resold.
Warning signs at checkout
- A spike in declined authorizations, especially CVV mismatch declines
- Many attempts on the same card number from different sessions
- Sequential or generated card numbers across a short window
- Traffic from data centers, proxies, or unusual geographies
- Low average order value with high attempt volume
- Multiple cards tried from one device or one customer account
Controls that reduce exposure
- Enforce rate limits by card number, IP address, device, and account.
- Require CVV at checkout and decline on mismatch. Never store the CVV after authorization.
- Apply address verification and step-up authentication for risky sessions.
- Set velocity rules for repeated declines and multiple cards per session.
- Monitor decline reason codes and alert on card-testing patterns.
- Use network tokens so exposed card data has less value to an attacker.
- Add friction, such as a challenge, when a session looks automated.
CVV enumeration versus BIN attacks
A BIN attack tests many card numbers that share an issuer prefix. A CVV enumeration attack usually focuses on guessing the CVV or expiry for card numbers the attacker already holds. Both are forms of card testing, and both produce similar decline patterns. Detection rules should cover both cases.
CVV Enumerate: What It Means and Why Card Testing Fails
Response when an attack is detected
Block the offending sessions, tighten velocity limits, and review recent authorizations for fraud. Notify the acquiring bank and follow its card-testing procedures. Report unauthorized payment fraud to law enforcement. Keep logs of the attempts so the acquirer and investigators can trace the pattern.