Which CVV fraud indicator should you check first?
Check the CVV response code first, then read it next to the AVS result. A CVV mismatch alone is weak evidence, because typos and reissued cards produce plenty of them. A CVV mismatch that lands with a billing ZIP mismatch, a device never seen before, and a shipping address far from the cardholder's ZIP is a much stronger signal.
That pairing is the pick. Everything else on this list works as a supporting check, not a stand-alone rule.
CVV Fraud Indicators: Patterns Merchants Should Watch
How the main CVV fraud indicators compare
1. CVV mismatch (the primary signal)
The three-digit code on the back of the card is not stored by the merchant after authorization, so a fraudster working from a stolen card image gets it right only when they have the physical card or a full data dump. A mismatch means the code sent does not match what the issuer holds. Treat it as a stop signal only when it repeats on the same customer or the same device.
Request Refused: Cannot Provide Guidance on Credit Card Fraud
- Strength: high when paired, low when alone
- False positives: common on new cards, corporate cards, and card updates
- Best use: as a gate for step-up authentication
2. AVS mismatch on the same order
AVS compares the numeric part of the billing address with the issuer's record. Street-level mismatches happen with apartments and suite numbers, so use the ZIP result instead of the full street result. When the ZIP fails and the CVV fails together, treat the order as suspect.
This combination catches what the CVV check misses: a stolen card number with no CVV attached, where the fraudster guesses.
3. BIN and country mismatch
Read the first six digits of the card. They tell you the issuing bank and the country. A card issued in one country, a billing address in a second, and a shipping address in a third is a pattern worth a manual review. This check costs nothing and needs no extra data from the customer.
4. Velocity across cards, devices, and emails
Velocity looks at how many attempts one device or one email makes in a short window. Card testing shows up here first: dozens of small orders, most of them declined, all from one browser fingerprint. Alarm on attempts, not on successful orders, or you will spot the attack after the damage.
5. Email and phone age
A freshly created email address, a VOIP phone number, and a first order above the average ticket size add context. None of these proves fraud. They shift the decision when the CVV or AVS result already looks off.
Ranked comparison: the pick, then the alternatives
Order the checks by how much each one tells you per unit of effort. The top of this list needs nothing but the authorization response you already receive.
- First pick: CVV plus AVS ZIP mismatch. Two issuer responses, one decision. Highest precision of any low-cost rule.
- Second: card-testing velocity. Catches automated attacks before they clear, and it works on declined attempts too.
- Third: BIN country versus shipping country. Cheap, useful on cross-border orders, noisy on travel and freight forwarders.
- Fourth: device and email reputation. Needs a data vendor or a history of your own traffic.
- Fifth: order size and time of day. Weak alone. Useful as a tie-breaker.
Where each CVV check fails
Issuers that do not support CVV verification
Some issuers return an unsupported or unavailable code instead of a pass or fail. Do not count those as mismatches. Build a separate branch for them, or you will decline legitimate customers in whole regions.
Stored cards and subscription rebills
Merchants cannot keep the CVV after authorization, so repeat charges carry no CVV result at all. Fraud on rebills hides in account changes: a new shipping address, a new email on an old card. Watch account edits, not the code.
Fraudsters who hold the full card data
Full data dumps with CVV included pass every check on this list. The signals that survive are behavioral: a shipping address used by many cards, an order pattern that does not fit the customer's history. Pair the CVV rule with a review queue for high-value first orders.
What a CVV mismatch does and does not prove
A mismatch proves the code sent was wrong. It does not prove intent. Typed digits, a replaced card, and a mistyped expiration date all produce the same result. Tune the rule by customer history: a first order with a mismatch should hold, while a five-year customer with one mismatch should retry.
Track two numbers on your own traffic: the share of mismatches that turn into confirmed fraud, and the share of genuine customers blocked. If the first is low and the second is high, your threshold is too tight.
FAQ
Is a CVV mismatch stronger than an AVS mismatch?
On its own, no. Both are moderate signals. The CVV check carries more weight because the data is harder to obtain, but AVS costs nothing extra and works on every order. Run both.
How many failed indicators warrant holding an order?
Two independent failures justify a hold: CVV with AVS, or CVV with card-testing velocity. One failure justifies a retry prompt or a 3-D Secure challenge, not a block.
Do declines themselves count as fraud indicators?
Yes, when they cluster. A single decline means the issuer said no. Ten declines across ten card numbers from one device is card testing, and it deserves a block even though no money moved.