CVV fraud indicators are the signals a payment system checks when a card is used without the card present. The CVV result is one signal. It is not proof of fraud, and it is not proof of a genuine cardholder. Issuers and fraud engines score it against address data, device data, and order data.
cvv fraud indicators compared to
What the CVV Check Returns
The card security code is 3 digits on the back for Visa, Mastercard, and Discover. American Express prints 4 digits on the front and calls it the CID. The issuer returns one letter during authorization:
CVV Fraud Indicators Compared: Pick the Strongest Signal First
- M: match
- N: no match
- P: not processed
- U: unavailable, the issuer does not support the check
- S: the card has no code printed
An N response raises the fraud score. An M response does not drop the score to zero.
cvv fraud indicators compared to
CVV Fraud Indicators vs Adjacent Signals
- CVV mismatch: the code does not match the issuer record. Causes include a typo, a new card, and a stolen number.
- AVS mismatch: street number or ZIP does not match. Weight rises when both the number and the ZIP fail.
- Shipping gap: ship-to address differs from the billing address on file.
- Velocity: 4 or more cards tried on one device or IP in an hour.
- Email age: the address was created within 30 days of the order.
- Geography: IP country, billing country, and ship-to country are three different values.
- Ticket size: the order total is 3 times the merchant average order value.
- Item type: resale goods, gift cards, and overnight shipping on a first order.
Fraud engines weight combinations. A CVV mismatch alone can score lower than a CVV match paired with a shipping gap and a new email.
Request Refused: Cannot Provide Guidance on Credit Card Fraud
Why the CVV Signal Fails Both Ways
False positives happen when a cardholder mistypes 3 digits or the issuer has not loaded the code. False negatives happen when a fraudster holds a full record that includes the code, the street address, and the ZIP. That record passes both checks. Public breach data and card-not-present fraud reports show this pattern. The FTC Consumer Sentinel Data Book lists credit card fraud as the top identity theft category by report count.
Rules on CVV Storage
PCI DSS Requirement 3.2 bans storage of the card verification code after authorization. The code cannot sit in a database, a log, or a printed receipt. A merchant cannot re-check the code later. The check happens once, at authorization.
Handling an Order With a CVV Mismatch
- Put the order on hold.
- Confirm 2 more signals, such as an AVS match and a ship-to that matches billing.
- Run 3-D Secure if the issuer supports it. Liability shift applies after a successful authentication.
- Route orders above a set value to manual review.
- Record the CVV response code for the dispute file. Do not store the code itself.
Limits of the Signal
No single field separates fraud from valid sales. CVV mismatch, AVS mismatch, velocity, and device data carry weight in combination. Merchants that block all N responses lose orders from cardholders who mistyped. Merchants that ignore N responses absorb chargebacks.