CVV Attack Defense: Stop Card Testing and Brute-Force Fraud

A CVV attack rarely breaks encryption. It guesses. Attackers fire thousands of small charges at a merchant to find card numbers, expiry dates, and CVV codes that an issuer will approve, then spend the verified cards somewhere else. For most US merchants the practical top pick is Stripe Radar if you already run payments on Stripe, because network-wide risk scoring, CVV and AVS enforcement, and custom velocity rules all work inside the same integration you already have. I judged every option below on five criteria: whether CVV is required and validated at authorization, how well the tool rate-limits by card, IP, email, device, and BIN, what it offers for 3-D Secure, how it handles chargeback evidence, and how many engineering hours it takes to switch on.

What a CVV attack actually looks like

A CVV brute-force attempt is a credential-stuffing problem wearing a payments costume. The CVV space is tiny: three digits on Visa, Mastercard, and Discover, four on American Express. An attacker who already holds a card number and expiry only has 1,000 or 10,000 guesses to work with, so the entire game is volume and distribution. One merchant sees a few hundred attempts; a thousand merchants each see a handful. That is why per-merchant rules catch some of it and network-level models catch more.

Patterns worth alerting on in your own data:

• Bursts of low-value authorizations, often between $0.50 and $3, arriving in minutes.
• Decline rates spiking well above your normal baseline while order volume stays flat.
• Many different card numbers from one IP, device fingerprint, or email domain.
• Card numbers that share a BIN prefix and run in sequence, the signature of a BIN attack.
• AVS mismatches paired with a CVV match, which is what a successful guess looks like.
• Disposable email domains and shipping addresses that do not match the billing country.

One structural fact shapes your whole defense: PCI DSS requires that sensitive authentication data, including the CVV and the full magnetic stripe data, not be retained after authorization. You are not allowed to store CVV for later review, and you should not want to. Verification has to happen in the authorization request itself.

Stripe Radar

Radar ships with Stripe Payments and scores every charge using signals from across the Stripe network, then lets you block, review, or allow based on rules you write.

• Pros: No separate vendor contract if you already use Stripe. Built-in CVC and AVS checks with configurable rules. Custom rules on card fingerprint, email, IP country, and velocity. Native 3-D Secure support through Stripe's authentication flow. Chargeback handling and evidence submission live in the same dashboard.
• Cons: Value depends on staying inside Stripe. Rule authoring has a learning curve, and poorly tuned rules will block good customers. Advanced risk features sit on higher tiers.

Recommendation: The default starting point for small and mid-size US merchants, especially subscription and digital goods sellers that see card testing first.

Adyen RevenueProtect

Adyen bundles risk management into its payment platform, so scoring, rules, and 3-D Secure decisions are configured alongside acquiring.

• Pros: One platform for acquiring and risk, which shortens the loop between a fraud signal and a blocked charge. Strong support for risk-based 3-D Secure, so low-risk transactions skip the challenge. Useful for merchants with meaningful international volume.
• Cons: Built for enterprises and larger mid-market businesses. Onboarding is heavier than a self-serve signup, and the risk tooling assumes you have someone who will tune it.

Recommendation: Best fit for merchants processing across multiple regions that want acquiring and fraud decisions in one place.

Sift

Sift is a standalone fraud and abuse platform that scores user behavior across sessions and accounts, not just single transactions.

• Pros: Strong at linking accounts, devices, and payment instruments into a network graph. Works across payment processors, so it survives a change of acquirer. Handles account takeover and promo abuse alongside payment fraud.
• Cons: Another integration and another bill. Value scales with volume; a merchant doing a few hundred orders a month gets less from the network effect.

Recommendation: A good choice when card testing is one part of a wider abuse problem, such as marketplaces and consumer apps with free trials.

Kount (Equifax)

Kount combines device intelligence, identity trust, and transaction scoring, with the backing of Equifax data for identity verification.

• Pros: Mature device fingerprinting that holds up against repeat attackers. Identity data helps separate a real customer on a new device from a fraud ring. Solid for merchants that must make fast allow or deny calls at checkout.
• Cons: Enterprise sales cycle and enterprise pricing. Configuration takes real effort, and the interface reflects years of accumulated features.

Recommendation: Suited to established ecommerce and financial services brands with a dedicated risk team.

The baseline controls that cost you nothing extra

Before buying anything, confirm these are on. Require the CVV field on every card-not-present transaction and reject mismatches rather than treating them as soft signals. Turn on AVS, and consider declining only when both AVS and CVV fail so you do not punish customers with a moved billing address. Enable 3-D Secure for high-risk orders and let risk-based rules decide when to challenge. Add velocity limits on the number of attempts per card, per IP, per email, and per customer account in a rolling window. Block repeat declines from the same device fingerprint for a short cooldown period. Notify your acquirer early when you detect an attack so decline fees and remediation are handled faster.

What cardholders can do

A CVV protects a transaction, not the account. Use virtual card numbers from your issuer for online merchants when they are offered, keep a separate card for recurring subscriptions, and turn on transaction alerts so a one-dollar test charge shows up as a notification instead of a line item you notice next month. Report a card you did not authorize to the issuer immediately; the card number is burned even if the charge was declined.

How to choose

If your stack is Stripe, start with Radar and spend your effort on rules and velocity limits. If you acquire across regions and want one platform, look at Adyen. If abuse extends beyond payments into accounts and trials, a standalone layer such as Sift or Kount earns its cost at volume. Every option above stops card testing only when CVV validation, AVS, velocity limits, and 3-D Secure work together, so budget time for configuration, not just for the contract.