Short answer
A CVV brute force attack is a series of authorization requests that guess the 3-digit or 4-digit card verification value. The attacker holds a card number and expiry date, then submits code guesses until one clears. The method fails at scale. Issuers cap attempts per card, processors track every decline, and a merchant that submits many guesses loses the ability to accept cards.
What the CVV is
- Visa and Mastercard: 3 digits, printed on the back, called CVV2 or CVC2.
- American Express: 4 digits, printed on the front, called CID.
- The code is not encoded on the magnetic stripe or the EMV chip.
- PCI DSS Requirement 3.2 bars merchants from storing the code after an authorization completes.
Because the code is not saved, a database breach yields card numbers without the verification value. That gap is the reason guessing exists.
Why guessing fails
The search space is 1,000 values for a 3-digit code and 10,000 for a 4-digit code. One request succeeds about 1 time in 1,000. Issuers count failed verifications and close or restrict a card after a small number of misses. Each miss returns a distinct decline code. A card tested 20 times leaves 20 records tied to one merchant ID, one IP range, and one device.
Controls that block the attack
- Velocity limits on the card, the merchant, and the BIN range.
- Address Verification System checks on the billing street number and ZIP.
- 3-D Secure step-up, which routes the request to the issuer for a passcode.
- Risk scores that weigh device fingerprint, IP address, and ticket size.
- Chargeback thresholds. Visa and Mastercard monitor merchants with high fraud ratios.
Signals a processor logs
- Decline rate above 10% on card-not-present traffic.
- Many authorization attempts on sequential card numbers.
- Small test amounts, then a large purchase.
- One device or IP block hitting many cards in minutes.
Legal exposure in the US
18 U.S.C. § 1029 covers access device fraud. Producing, selling, or using stolen card credentials carries up to 10 years for a first offense and up to 15 years with prior convictions. The Department of Justice prosecutes carding operations, and forfeiture applies to proceeds and equipment.
Cardholder steps
- Read statements each month and dispute unknown charges.
- Turn on transaction alerts for each authorization.
- Use virtual card numbers at online merchants.
- Freeze the card in the issuer app when a charge looks wrong.
Unknown: no public figure exists for how many CVV guesses a specific issuer allows. Limits are set per issuer and are not disclosed.