What a CVV attack IOC is
A CVV attack indicator of compromise (IOC) is a log signal that shows someone testing card numbers and CVV codes against a payment endpoint. The goal is to find valid card data. The attack is a form of card testing, also called carding or a BIN attack. IOCs show up in authorization logs, web server logs, and fraud dashboards.
Common IOCs
- Many authorization attempts from one IP address in a short window. Example: 50 attempts in 10 minutes.
- Card numbers that follow a sequence or fall in a narrow BIN range.
- High decline rate on one merchant ID. Example: 80 percent declines with response code 05 or 51.
- Repeated CVV mismatch responses, such as code N7 or CVV failure codes.
- Low average ticket size. Attackers test with $0.00 to $1.00 authorizations.
- Same device fingerprint or session cookie across many card numbers.
- User agents that do not match the browser profile, or headless browser strings.
- Failed attempts spread across many IPs but one card BIN, or one IP but many BINs.
- Account signups with disposable email domains before card tests.
Where to look
Authorization logs
Check response codes, CVV result codes, AVS result codes, and timestamps. Group by IP, device ID, and BIN. Look for bursts.
Web and API logs
Check request rate to the payment endpoint, POST body size, and error codes. Card testing often hits the same URL path at high volume.
Fraud dashboards
Check decline rate by hour, average ticket, and count of distinct cards per device.
Response steps
- Rate limit the payment endpoint by IP and device ID.
- Block the BIN range or IP set that shows the burst.
- Require CVV and AVS for all authorizations. Do not store CVV.
- Add a CAPTCHA or step-up check for new devices.
- Review chargebacks tied to the same BIN or device.
No single IOC proves an attack. Use at least two signals before you block traffic. Keep a record of false positives.