CVV Fraud Rules: Card Network, PCI DSS, and US Law Guide

CVV fraud rules are the card network standards, PCI DSS requirements, and federal criminal laws that control how a card verification value is collected, stored, and checked, and what happens when someone uses a CVV without the cardholder's permission. Buying or using another person's CVV is a federal crime in the US under 18 U.S.C. § 1029, and a first offense carries up to 10 years in prison. Merchants and processors that keep CVV data after authorization break PCI DSS rules, which brings fines, added chargebacks, and the loss of card acceptance privileges.

What is a CVV and where does it appear?

A CVV is a short security code that ties a card to the physical plastic in the holder's hand. Card networks print the code in different places and give it different names, which matters when you read a rule that refers to CVV2, CVC2, CID, or iCVV.

• CVV2: the 3 digits on the back of Visa, Mastercard, and Discover cards.
• CVC2: the same 3 digits under Mastercard's label.
• CID: the 4 digits on the front of American Express cards.
• CVV1: the code encoded in the magnetic stripe, read when a card is swiped in person.
• iCVV: the chip version, which changes with each transaction.

Which rules apply to CVV data?

Three rule sets cover a card-not-present transaction: payment network operating rules, PCI DSS data standards, and federal criminal law. Each one governs a different part of the problem.

Payment network rules

Visa, Mastercard, American Express, and Discover require merchants to send the code with the authorization request on phone, mail, and online orders. The network compares it against the issuer's record and returns a match, no match, or not processed response. That response is one fraud signal among several, not a final verdict on the buyer.

PCI DSS data rules

• PCI DSS forbids storing sensitive authentication data, including the CVV2, the full magnetic stripe, and the PIN block, after authorization.
• The code may pass through a payment system only during the authorization step, and encryption does not create an exception.
• Any receipt, report, or log that shows the printed code puts the merchant out of compliance.

Federal criminal law

18 U.S.C. § 1029 covers producing, selling, using, and possessing card credentials with intent to defraud. Penalties scale with the number of devices in the case: up to 10 years for a first offense, and up to 15 years when 15 or more devices are involved. Wire fraud charges under § 1343 add up to 20 years, and aggravated identity theft under § 1028A adds a mandatory 2-year term on top of the fraud sentence.

When does a CVV check shift fraud liability to the issuer?

Visa's card-not-present liability shift moves the loss from the merchant to the card issuer when the merchant obtained a CVV2 match and a full address verification match before shipping the order. The rule rewards sellers who check both fields, because a single CVV match leaves the merchant holding the loss. A match does not prove the buyer is the cardholder. Anyone who holds the physical card or a full data dump has the printed code as well.

What happens to a merchant with a high CVV fraud rate?

Card networks track fraud-to-sales ratios by merchant account. Crossing a network threshold places the account in a monitoring program with monthly fines billed to the acquirer, and those fines pass down to the merchant. Accounts that stay above the threshold face termination, placement on the MATCH list, and rejection by other processors.

How does a cardholder dispute a CVV fraud charge?

1. Review your statement and flag every charge you did not authorize.
2. Call the issuer's fraud line. The bank freezes the card and mails a replacement with a new number.
3. Send a written dispute to keep the protection of the Fair Credit Billing Act. You have 60 days from the statement date that shows the error.
4. The issuer must acknowledge the dispute within 30 days and resolve it within two billing cycles, or 90 days, whichever comes first.
5. Debit cards follow different rules. Report a lost or stolen debit card within 2 business days to cap your loss at $50. Wait past 60 days and that cap disappears.

Visa and Mastercard zero liability policies cover most card-not-present fraud for consumers, so a dispute rarely leaves the cardholder out of pocket. The cost lands on the merchant or the issuer.

Common questions about CVV fraud rules

Is it illegal to buy a CVV from someone else?

Yes. Buying a CVV that belongs to another person falls under 18 U.S.C. § 1029, which covers the sale, transfer, and possession of unauthorized access devices. Prosecutors build these cases from shipping addresses, device fingerprints, and payment trails, and the charge carries a felony record.

Can a merchant ask for the CVV over the phone?

Yes. An agent may ask for the code during the call, but the number cannot be written on paper or stored in the order system once the authorization is complete. Keeping it for a future charge is a PCI DSS violation even when the customer agrees.

Does a CVV match prove the buyer is the cardholder?

No. A thief who holds the card, or who has a full data dump of the account, has the printed code along with the card number. A match confirms the code is valid, not that the person using it has permission from the account owner.

What is the difference between CVV fraud and chargeback fraud?

CVV fraud means a purchase made with a code the buyer had no right to use. Chargeback fraud means a real cardholder disputes a charge they actually made. Both follow the same dispute process, but only the first is a federal crime at the point of sale.

What should a merchant do when a CVV check fails?

Hold the order and request another proof of identity, such as a bank authorization or a callback to the number on file. Shipping an order that failed the CVV check hands the full loss to the merchant once the cardholder files a dispute.