What CVV fraud prevention actually requires
CVV fraud is a card-not-present crime. A thief holds a stolen card number and needs the three or four digit verification code printed on the card to push a charge through. Prevention comes down to two jobs: keep that code out of your systems so a breach cannot leak it, and make the code by itself insufficient to complete a purchase. Merchants do this with issuer authentication, address checks, spending limits, and monitoring. Cardholders do it by treating the code like a password and reading their statements.
Prerequisites
- A PCI DSS compliant payment stack, or a hosted checkout that keeps card data off your servers.
- Access to the address verification (AVS) and CVV response codes your processor returns.
- Authority to change your checkout flow and fraud rules.
- A written chargeback and dispute procedure.
Steps to cut CVV fraud
- Stop storing the verification code. PCI DSS forbids retaining sensitive authentication data after a transaction is authorized, so purge any CVV field from databases, order notes, and email receipts.
- Require the code on every card-not-present charge. A missing or mismatched code should block the sale, not just flag it.
- Turn on AVS and act on the result. Match the billing street address and ZIP to the issuer record, and decline on a full mismatch.
- Enable EMV 3-D Secure. The issuer authenticates the cardholder in a separate step, which shifts liability for most approved transactions.
- Tokenize stored card numbers. Replace the PAN with a token so a future breach exposes nothing reusable.
- Set velocity limits. Cap the number of attempts per card, per IP address, and per device in a rolling window.
- Screen orders with device and IP signals. Flag mismatches between the buyer's location, the shipping address, and the card's issuing country.
- Review fraud flags daily. Clear the queue of suspected orders before shipping, and record the reason for each decision.
- Train staff on phone and mail orders. Anyone keying a card manually should verify the caller against prior order history.
What cardholders should do
- Never read the code aloud in public or send it by email, chat, or text.
- Shop only on pages with a valid TLS certificate and a known merchant name.
- Check statements every month and dispute unknown charges with the issuer.
- Freeze the card from the bank app the moment a charge looks wrong.
When fraud gets through
Contest the chargeback with the AVS and 3-D Secure results attached. Report internet-enabled card fraud to the FBI Internet Crime Complaint Center and, for identity theft, file a report with the FTC. Then check why your rules failed: a mismatched code that was overridden, a new attack pattern, or a gap in the velocity settings. Tighten the rule, and log the change so you can measure the effect over the next billing cycle.