What CVV and AVS check
CVV is a 3- or 4-digit code on a payment card. AVS compares the billing address to issuer records. The issuer returns a result code. These checks flag possible fraud. They do not prove the person holds the card.
How a CVV test runs
A CVV test sends the code to the issuer. The issuer returns match, no match, or not checked. A mismatch can decline the charge. Processors set their own rules for retries and review. Use sandbox test card numbers from your processor. Do not use live card data unless you are the cardholder or have written permission.
How an AVS test runs
AVS sends the numeric street address and the ZIP code. The issuer returns a code. Common codes: Y for full match, N for no match, A for partial match, Z for ZIP match only. Each processor maps codes to its own thresholds.
Test cases to run
- CVV match with AVS full match.
- CVV mismatch with AVS full match.
- CVV match with AVS ZIP-only match.
- CVV mismatch with AVS no match.
- AVS partial match with CVV not checked.
Check decline codes and review triggers for each case. Confirm that your system does not store the CVV after authorization. PCI DSS requires this limit.
Legal limits
Using card data you do not own is illegal. Test environments exist for this reason. A sandbox card number simulates issuer responses without moving money. Treat CVV as sensitive data. Do not log it. Do not send it in email.