Answer first
Card verification is a set of checks that compare order data against data the issuer holds. The checks have several names. The names differ by network, processor, and region. The defenses are the same controls. A merchant that runs address checks, CVV checks, and 3-D Secure on the same order closes most card-testing routes.
Synonym map
- CVV, CVV2, CVC, CVC2, CSC, CID, CAV2 all name the 3 or 4 digit code printed on a card. Visa uses CVV2. Mastercard uses CVC2. American Express uses CID. The code sits on the card and is not stored in the magnetic stripe or the chip.
- AVS (Address Verification Service) compares the street number and ZIP the buyer types against the issuer file. It returns a single-letter code.
- 3-D Secure, 3DS, EMV 3DS, Verified by Visa, Mastercard Identity Check, SafeKey all name issuer-side authentication with a challenge step.
- Card tokenization, network token, DPAN name the replacement of the card number (PAN) with a token that works inside one channel.
- BIN check, IIN check reads the first 6 to 8 digits to confirm the issuer and card type.
- Card testing, card stuffing, enumeration name the attack, not a defense.
Why the names split
Each card network writes its own rulebook. A processor then maps those rules to its own API fields. One gateway calls the field cvv, another calls it card_code, a third calls it security_code. The check is identical. Read the processor documentation before you build logic on a field name.
question what are the best defense strategies for card testing?
Defense controls that matter
- Do not store the CVV. PCI DSS requirement 3.2 bars storage of sensitive authentication data after authorization. There is no business case for keeping it.
- Require a CVV result on card-not-present orders. Set a rule to decline a mismatch. Track match rates per BIN.
- Run AVS and require a match on the street number or the ZIP. A full match on both is stronger.
- Apply 3-D Secure to high-risk orders. Route by amount, country, and account age. The issuer takes the fraud loss on a successful challenge.
- Set velocity limits. Count attempts per card, per IP, per device, and per email in 1 hour and 24 hour windows.
- Block repeated declines. A card that fails 3 times in 10 minutes is a test pattern, not a customer.
- Use tokens for repeat buyers. Keep the PAN out of your database.
- Watch small tickets. Card testing starts with low amounts to check validity. Flag any cluster of $1 to $3 charges across many cards.
What stays unknown
Issuer rules for AVS and CVV response codes are not public in full. Each acquirer publishes its own code table. Test your rules against real decline data before you set a hard block.