Ultimate Guide to Payment Card Testing for Online CVV Sales
Discover the essential steps for effective payment card testing when selling CVV online.
Payment Card Verification: CVV, AVS, and 3-D Secure Explained
Payment card verification is the set of checks a merchant runs to confirm that the card details in a transaction belong to the person using them. The three that matter most are CVV verification, Address Verification Service (AVS), and 3-D Secure cardholder authentication. Each catches a different problem, and none of them proves a transaction is legitimate.
payment card verification tool
What each check actually confirms
CVV and CVC
The three or four digit code printed on the card confirms that whoever typed the number had the physical card, or a copy of it, in hand. It says nothing about whether that person is the cardholder. Under PCI DSS, a merchant may not store the CVV2 after authorization. It is a one-time check, not a reusable credential.
AVS
AVS compares the billing address and ZIP code the buyer entered against what the issuer has on file. It returns a code, not a yes or no. A street match with a ZIP mismatch means something different from a full mismatch, and both mean something different from a full match. Issuers outside the US and Canada often do not support it, so an empty result is not automatically a red flag.
3-D Secure
3-D Secure passes the cardholder to the issuer for a challenge, usually a password or an approval in the bank's app. When authentication succeeds, fraud liability shifts to the issuer. Version 2 also runs a risk assessment in the background, so plenty of low-risk transactions go through with no prompt at all.
Why the CVV is not a password
People treat that three digit code as a secret. It is not, in any practical sense. It sits on the card, within reach of anyone who handles it, including a waiter, a hotel clerk, or a coworker who borrows the card to order lunch. A breach that captures the card face or the magnetic stripe captures the CVV along with it. CVV verification filters out the laziest attacks and little else. I look at it as a speed bump, not a lock.
What verification cannot do
- Catch an attacker who already has the full card data. Every check above will pass.
- Stop a legitimate cardholder from disputing a charge later, whether the dispute is honest or not.
- Replace authorization. A verification result is not an approval, and a decline is not always fraud.
- Tell you who is typing. It tells you what data they have.
What layered verification looks like
- Tokenize card data so the real number never sits in your systems. This shrinks PCI scope and removes a breach target.
- Run a risk score on the order: device, email age, shipping distance, order value against history.
- Apply velocity limits per card, per IP, and per shipping address.
- Step up to 3-D Secure when the risk score says so, not on every order.
- Review flagged orders by hand. A person reading the details catches patterns a rules engine misses.
The cardholder side
If you carry a card, treat the CVV like cash in your pocket. Do not read it aloud in a store, do not photograph it, and do not type it into a site you have not checked. Virtual card numbers from your issuer limit the damage when a merchant gets breached, because the number you gave out stops working.