Guessing a CVV does not work as a way to use a payment card. A card verification value is a 3 or 4 digit code checked against the issuer's record, and each wrong entry is logged, risk-scored, and typically blocked well before anyone cycles through the 1,000 possible three-digit combinations. Real card-not-present fraud runs on stolen full card data and automated card testing at scale, not on blind guessing against one account.
What is CVV guessing?
CVV guessing means submitting repeated card verification values against a card number in the hope that one matches. The CVV2 printed on the back of a Visa or Mastercard, and the four-digit code on the front of an American Express card, is generated by the issuer and never appears in the magnetic stripe or chip data.
Because the code is short, people sometimes assume it can be brute-forced. In practice the code is only one of several checks applied to a transaction, and the surrounding controls are what stop the attempt.
Why does CVV guessing fail in practice?
A three-digit field gives 1,000 combinations, and a four-digit field gives 10,000. Even a generous attempt allowance is far smaller than that, so the odds of a hit inside the allowed window are close to zero.
- Attempt limits: issuers and processors cap verification attempts per card and per merchant, then decline further tries.
- Velocity rules: repeated declines on one card, one device, or one IP address trigger blocks and manual review.
- Fraud scoring: risk engines weigh device history, geolocation, email age, and basket size against the card's normal pattern.
- Address verification: AVS results combine with CVV results, so a correct code alone rarely clears an order.
- Chargeback liability: a merchant that ships on a mismatch absorbs the loss, which keeps tolerance for failures low.
How does card testing differ from guessing?
Card testing is a volume attack, not a guessing attack. Criminals who already hold stolen card numbers run many small authorizations across many cards to find out which ones are still live, then resell or monetize the working ones.
That pattern is visible: clusters of low-value orders, high decline ratios, disposable email addresses, and several cards tried from one device in a short window. Payment processors and fraud platforms flag it quickly, and card networks share that intelligence with acquirers.
How do merchants block verification attempts?
Merchants that accept card-not-present payments stack several controls instead of relying on the CVV check alone.
- Rate-limit authorization attempts per card, per customer, and per IP address.
- Require CVV and AVS match on first orders from new customers.
- Apply 3-D Secure or strong customer authentication where the market supports it.
- Use device fingerprinting and behavioral signals to spot scripted checkout traffic.
- Monitor decline ratios and pause checkout flows that show card testing signatures.
- Never store the CVV after authorization, which PCI DSS prohibits.
Is CVV guessing illegal in the US?
Yes. Unauthorized use of payment card data is a federal offense under 18 U.S.C. Section 1029, and network rules bar merchants and service providers from handling card data outside PCI DSS controls. Marketplaces that advertise stolen card numbers or verification values are operating illegally, and buying from them carries direct legal and financial risk.
Cardholders in the US are protected against fraudulent charges under federal law, and issuers generally reverse unauthorized transactions once reported.
What should a cardholder do after a failed verification alert?
Treat unexpected decline notices or verification messages as a signal that the card number may be exposed. Contact the issuer using the number on the back of the card, review recent activity, and request a replacement card and new CVV.
Merchants should treat the same signal as a reason to review their fraud rules rather than to loosen them.