A CVV test website is a tool that runs stolen card numbers and security codes through authorization requests to see which ones still work. That makes it a fraud instrument, not a payment service, and using one can bring federal criminal charges. Shoppers and merchants never need a CVV test site, because real card validation happens inside a payment processor during a live sale.
What does a CVV test website do?
These services take bulk lists of card numbers, card verification values, and expiration dates, then submit low-value charges or zero-dollar authorizations to sort live accounts from dead ones. Sellers market them as "validators" or "checkers," but the output is the same: a list of working stolen cards for resale.
- Bulk runs: thousands of card numbers pushed through automated scripts in minutes.
- Small probes: charges of a dollar or less, aimed at slipping past fraud rules.
- Resale output: approved cards repriced higher on carding forums.
The CVV is a 3-digit code on the back of most Visa, Mastercard, and Discover cards, and a 4-digit code on the front of American Express cards. It exists to prove that the buyer holds the physical card.
CVV test website vs payment gateway: what is the difference?
A payment gateway validates card data as one step of a purchase, with a cardholder who agreed to pay and funds that land in a merchant account. A CVV test site runs the same authorization step with no purchase, no consent, and no cardholder.
- Goal: a gateway completes a sale. A test site confirms that stolen data works.
- Consent: a gateway has cardholder approval. A test site has a victim.
- Money: a gateway moves funds to a business. A test site sells the card data.
- Status: a gateway is licensed and regulated. A test site is criminal.
Why do CVV checks exist in the first place?
Card networks added verification codes to cut down on fraud from stolen card numbers alone. A thief with a card number and expiration date could once place an order without the plastic in hand. Requiring the CVV raises that bar for online sellers and shifts the risk onto anyone who lacks the card.
For merchants, a CVV check is one input in a fraud decision, next to address verification, device fingerprints, and 3-D Secure. None of these are a separate product you buy from a third party to "test" cards in bulk.
Is it illegal to use or sell a CVV test website?
Yes. In the United States, 18 U.S.C. § 1029 covers fraud and related activity in connection with access devices, and courts apply it to producing, selling, and using unauthorized card data. Penalties scale with the loss and can include prison time and fines.
Trafficking in counterfeit access devices is a federal offense on its own, so running a checking service carries exposure even without using a single card. Card networks add a second layer: issuers and acquiring banks can close merchant accounts tied to card testing, and the brands levy fines through their fraud programs.
Other countries treat it much the same. The UK Fraud Act and Computer Misuse Act, Canada's Criminal Code, and EU payment services rules all cover unauthorized use of card credentials.
How do merchants spot card testing attacks?
Card testing leaves a pattern that most risk engines catch within hours. Watch for these signals on a store's own checkout:
- A burst of declines from one IP range or device fingerprint.
- Dozens of small orders in minutes, often from the same card BIN range.
- High CVV mismatch rates tied to one account or one session.
- Billing countries that do not match the shipping country or the card issuer.
- Sequential card numbers, a sign of a BIN attack.
The defenses are standard tools, not exotic ones: require CVV on every card-not-present order, turn on address verification, set velocity limits per IP and per card, and use 3-D Secure for high-risk orders.
How does card testing hurt a real store?
Every test charge that approves becomes a chargeback when the true cardholder spots it, and chargebacks carry fees plus a hit to the merchant's ratio. Processors raise rates or drop accounts that keep showing test traffic. A store can lose its ability to accept cards over fraud it never committed.
Cardholders lose too. Victims deal with replacement cards, disputed charges, and the chore of updating every stored payment method.
What should you do if you find a CVV test site?
Do not enter card details on any page that offers to "verify" or "check" a card without a purchase. Report the site to the FTC's fraud reporting portal, to the FBI's Internet Crime Complaint Center, and to the card issuer printed on the card.
Merchants who see test traffic should call their acquirer the same day, switch on the fraud filters listed above, and block the offending IP ranges. Speed matters, because a testing run lasts for minutes, not weeks.
FAQ
Can a CVV test website prove that a card is valid?
An authorization result only shows that an issuer approved a request. It does not make the person running the check the cardholder. The approval is evidence of access device fraud, not proof of ownership.
Do people sell CVV data on the same sites?
Many testing services also act as storefronts for card dumps, and some take payment and deliver nothing at all. The tool and the marketplace are the same business.
Is any CVV check legal?
Only inside a licensed payment environment with real consent. Issuers, processors, and PCI-compliant labs test with synthetic card numbers in sandbox systems, never with live customer accounts.
What happens if a stolen card is used on a real store?
The order gets flagged or reversed, the merchant eats the chargeback, and law enforcement can pull IP logs and shipping records with a subpoena. Nobody in that chain wins except the seller of the test tool.