Choose from any of our gift cards to give to your loved ones
CVV Signature Verification: What It Means and How It Works
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A CVV attack signature is the measurable pattern a payment gateway records when someone submits many card numbers to one merchant to learn which card number, expiry, and security code combinations authorize. It is a behavioral fingerprint built from request metadata, not a file or a virus. Risk teams use it to stop card testing and card enumeration before chargebacks arrive.
Issuers and gateways assemble the signature from request context, not just the card fields themselves. The strongest signals repeat across nearly every observed campaign.
Card testing checks whether a complete card works. CVV enumeration holds a known-good card number fixed and guesses the three- or four-digit code, producing a burst of security code failures against a single account number. That one-card, many-code pattern is the clearest signature in the family.
No universal number exists, but most risk engines flag a card after three to five failed code attempts inside a short window, or an IP after roughly ten declines in an hour. Rules are tuned per merchant because subscription billing and B2B invoicing carry naturally higher retry rates.
PCI DSS forbids retaining the card verification value after authorization, so the signature must be captured in flight. A merchant who stores codes to analyze them later is out of compliance and exposed. Detection belongs in the authorization request path, not in a nightly report.
No. Typos and stale stored credentials create legitimate mismatches, which is why signatures rely on behavioral clusters rather than one decline.
Yes. Distributed botnets rotate IPs and devices to dilute velocity signals, so engines weight BIN clustering and failure ratios alongside network reputation data.
