Choose from any of our gift cards to give to your loved ones
CVV Attack Mitigation Best Practices Guide
Redeem your gift cards at any of our Merchants
Reducing CVV Attack Risk: A Merchant Guide to Card Testing Defense
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A CVV attack is a card testing run. Someone submits many card numbers and CVV values to a payment form. Each submission is a small authorization. The attacker keeps the numbers that return an approval. Mitigation tools work on three layers: request rate, payment data checks, and cardholder verification. No single tool covers all three. A stack of four to six controls stops most runs.
Set hard caps on authorization attempts. A common starting point:
Cap attempts per billing email and per shipping address too. Attackers rotate IP addresses through proxy pools, so pair IP caps with device and card caps.
Require the CVV field on every card-not-present transaction. Decline the order when the issuer returns a CVV mismatch response code. Route repeated mismatch codes on one card number to a blocklist. Do not store the CVV after authorization. PCI DSS Requirement 3.2 classifies the value as sensitive authentication data and forbids retention once the transaction completes.
3-D Secure adds an issuer challenge to the authorization flow. EMVCo maintains the specification. Version 2 supports risk-based challenges, so a low-risk buyer passes without a prompt. Attacks fail here because the attacker does not control the cardholder phone or banking app. Expect friction on some legitimate orders and a drop in approval rates of 1 to 3 points.
Bot management tools score each session on header order, TLS fingerprint, mouse movement, and timing. Place a challenge on the payment step when the score falls below your threshold. Static image CAPTCHA fails against commercial solving services. Use invisible challenges first and escalate.
AVS compares the billing address to the issuer record. A mismatch does not prove fraud. Combine AVS results with CVV results. Decline on a CVV mismatch with an AVS mismatch. Review a CVV match with an AVS mismatch.
Write rules on issuer response codes, not on order value. Block the card BIN ranges that generate most of your mismatches. Block disposable email domains. Block known proxy and hosting IP ranges.
Alert when the CVV mismatch rate for one BIN passes 10 percent in an hour. Alert when authorization volume for one merchant account doubles against the trailing 7-day average. Watch authorization-to-settlement ratios. Test runs leave a trail of small approvals and voids.
Tools do not remove card data from your systems. Tokenization and hosted payment fields do that. Tools do not stop a manual attack from residential IP addresses. Review queues handle that case. Tools also do not replace chargeback monitoring. Card networks track fraud ratios per merchant account.
