CVV Verification Guide: How to Safely Buy CVV
Learn how to verify CVV codes safely when buying CVV online. This guide provides essential steps and tips for secure transactions.
Our Cards
Choose from any of our gift cards to give to your loved ones
Choose from any of our gift cards to give to your loved ones
Redeem your gift cards at any of our Merchants
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A CVV velocity check is a fraud control that counts how many card verification value (CVV) attempts are tied to a card, account, device, IP address, or BIN within a defined time window. When that count crosses a threshold, the risk engine blocks the transaction, queues it for manual review, or forces step-up authentication. It is one of the cheapest ways to catch card testing, where fraudsters run thousands of small orders to find live card numbers.
It measures frequency, not identity. The rule tracks how often a CVV check is attempted across a rolling period such as 10 minutes, 1 hour, or 24 hours. Merchants rarely store the CVV itself, because PCI DSS prohibits retaining sensitive authentication data after authorization.
Instead, the check keys off derived signals: the CVV response code, the card BIN, the customer account, the device fingerprint, and the IP address. That is why velocity rules survive even though the three-digit value does not.
Counters usually decay on a rolling basis so a legitimately busy customer is not permanently penalized. Some engines also weight failed CVV responses more heavily than successful ones.
Common starting points are three to five CVV attempts per card per hour, and ten to twenty per IP per hour. High-risk verticals such as digital goods and gift cards often run tighter limits because card testing targets them first.
Thresholds should be tuned against your own approval and chargeback data. A rule that is too tight will decline good customers, and a rule that is too loose will not stop automated attacks.
Card testing generates a burst of activity that normal shoppers never produce. One card number, or one device, suddenly appears across dozens of orders in minutes. Velocity rules detect that pattern even when each individual transaction looks clean.
The control also raises the cost of an attack. Fraudsters must slow down, spread across more infrastructure, and accept lower success rates, which makes the operation less profitable.
Velocity checks are reactive at the edges: a determined attacker can stay just under the threshold. They also produce false positives during legitimate spikes such as flash sales or subscription renewals.
Because CVV data cannot be stored, the rule depends on gateway and processor data being available in real time. Latency in that pipeline weakens the control.
Start with monitoring mode so you can see how often real customers would trip the rule. Then move to review mode, and only enable hard blocks once the false-positive rate is acceptable.
Pair velocity limits with address verification, 3-D Secure, and device reputation for layered defense. No single rule stops card testing on its own.