CVV Fraud Detection Utility Guide
Discover how a CVV fraud detection utility can help you combat credit card fraud when selling CVVs online.
CVV Validation Guide for Merchants | What M, N, U Codes Mean
The short answer
CVV validation is one signal, not a verdict. Your gateway passes the card's verification value to the issuer during authorization, the issuer compares it to the value on file, and you get back a single-letter result. A match means whoever typed that number had the card in hand, or had a copy of the back of it. A mismatch means they probably did not. Neither result proves the buyer is the cardholder, and neither one settles the charge by itself.
I treat the code as one input in a rule set, never as a standalone gate. Merchants who flip a switch to "decline every mismatch" usually lose good orders and still get hit.
The result codes you will actually see
- M (match): issuer confirms the value. Reasonably strong evidence the card was present at some point.
- N (no match): the value is wrong. This is the one that should make you look harder.
- U (unavailable): the issuer does not participate or cannot check. Common outside the US and with some card products.
- P (not processed): the check never ran, often because the transaction failed earlier in the flow.
- S (should have been present): the field was required and you did not send it.
Note that a mismatch does not automatically decline anything. Many issuers still approve the authorization with an N attached. The decision to ship or cancel is yours.
What it catches
The classic case is a stolen card number with no CVV attached. Someone buys a dump of account numbers from a breach, none of which include the three or four digits printed on the card, and tries them. Requiring CVV kills most of that traffic cheaply. It also raises the cost of an attack, since a fraudster now needs a full card image rather than a number.
What it misses
Plenty. A card photographed at a restaurant or skimmed at a pump gives the attacker everything, CVV included. A cardholder who is being socially engineered will happily read off the digits. And a mismatch tells you nothing about intent: typos, a spouse using the wrong card, and a genuinely stolen number all produce the same N. That is why AVS, device fingerprinting, order velocity, and identity checks still carry weight.
Card testing is a pattern problem
Fraudsters validate stolen numbers in bulk before cashing out, and they do it with small amounts. A fifty-cent authorization today proves the card works tomorrow. The tell is not one order, it is the shape of the traffic: dozens of attempts from one IP or device, sequential card numbers, email addresses that look generated, and a spike in declines or CVV mismatches over a short window.
Watch your authorization attempt ratio, not just your fraud rate. If you see repeated low-value attempts from one fingerprint, block the fingerprint, not just the card.
Rules that hold up
- Require the field on every card-not-present order and reject submissions where it is missing.
- Decline N outright for high-risk verticals and high-ticket items. Accept it with review for low-value repeat customers.
- Treat U as neutral and route it to another check, such as AVS or 3-D Secure.
- Rate-limit by device and IP, and kill the session after a handful of failures.
- Feed every result code into your model. The code is a feature, not a gate.
The storage rule people get wrong
You may pass the value through to the issuer. You may not keep it. PCI DSS classifies the CVV as sensitive authentication data, and it must not be stored after authorization in any form, encrypted or hashed, on any system. Logs count. Debug dumps count. If a support agent can pull a full card image out of your ticketing tool, that is a finding waiting to happen.
Where 3-D Secure fits
Protocols like EMV 3-D Secure shift the authentication step to the issuer, which is stronger than a static value printed on the card. Liability shifts too, in most cases. For merchants with thin margins and high volumes, 3DS plus a CVV requirement plus decent velocity rules covers a lot of ground. Nothing covers all of it.