What a CVV velocity check measures

A CVV velocity check counts how many times a card verification value is submitted from one identifier inside a set time window. Identifiers include card number, IP address, device fingerprint, billing ZIP, email, and merchant account. The check does not read the CVV. It counts attempts that carry one.

Card networks do not store CVV values. Issuers compare the submitted value to the value on file at the moment of authorization. A velocity rule sits in front of that comparison, at the gateway or at the fraud platform.

Common thresholds

  • Card number: 3 to 5 attempts per 24 hours.
  • IP address: 10 to 30 attempts per hour at one merchant.
  • Device ID: 5 or more distinct card numbers per hour.
  • BIN range: a share of total attempts above the baseline for that range.
  • Email or phone: repeated use across distinct card numbers.

Why card testing trips the rule

Card testing sends many low-value authorizations to find numbers that work. Each attempt returns an issuer response code. A 200 approval plus an address verification match confirms the number is live. Volume against one identifier rises fast. A velocity rule catches the pattern before the issuer posts a chargeback.

What the check does not do

A velocity check cannot confirm a card is stolen. A merchant with repeat customers can trip the same rule. False positives are common at subscription renewal dates and holiday peaks. Analysts pair velocity data with CVV match results, AVS codes, and device reputation before they block an order.

Limits at the authorization layer

Issuers run their own velocity checks across their portfolio. A merchant sees only its own traffic. A fraud ring that spreads attempts across thousands of merchants stays under any single threshold. Network-level scoring, such as Visa Advanced Authorization, sees the aggregate.

Data retention

PCI DSS bars storage of sensitive authentication data, including the CVV, after authorization. Velocity systems keep counts, timestamps, and hashed identifiers. They do not keep the CVV itself.