A CVV enumeration catalog is a compiled list of card numbers matched with security codes that someone obtained by testing many three-digit values against each card. Sellers offer these lists on criminal markets as "verified" card data, often with a claimed hit rate. Buying, selling, or using one is a federal crime in the United States, and most entries stop working within days.
cvv enumeration database search
What does a CVV enumeration catalog contain?
A catalog entry pairs a primary account number with a card verification value and the expiration date. Sellers add extra fields to make the data look richer than it is.
- Card number (PAN), expiration date, and the guessed CVV
- Card brand and BIN, which identifies the issuing bank
- Cardholder name, billing ZIP, and country, when the seller has them
- A claimed "valid rate," a number no buyer can check in advance
Lists get sorted by BIN, country, or card brand so buyers can pick targets by bank. A large share of the entries are dead cards, duplicates, or invented rows added to inflate the file size.
How does CVV enumeration work?
A card verification value is a three-digit code printed on the back of most cards (four digits on American Express) that proves the buyer holds the physical card. It is not stored in the magnetic stripe or the chip, so a card number alone does not reveal it.
An attacker submits a small authorization against a card number with a guessed code, then reads the response. A mismatch returns a decline. An approval tells the attacker the code is correct. Repeat that across thousands of card numbers and the approved pairs become a catalog.
That is the theory. In practice, every guess is a separate authorization message that the issuer, the processor, and the card network all see and score in real time.
Why do CVV enumeration attempts fail?
Payment systems are built to spot repeated failures, and the defenses sit at several layers at once.
- Velocity limits. Issuers lock or reissue a card after a handful of failed code attempts.
- Risk scoring. Processors flag bursts of attempts from one device, IP range, or merchant account.
- 3-D Secure. Many online transactions require a second step, such as a one-time code or an approval in the bank app.
- Tokenization. Merchants that store tokens never hold the CVV at all.
- Short shelf life. Reissued cards void the old number, so a catalog ages out fast.
Banks also watch for the setup that enumeration needs: many low-value test charges, datacenter IP addresses, and checkout sessions that skip normal browsing behavior.
Is buying a CVV enumeration catalog legal in the US?
No. Trafficking in card numbers and security codes falls under federal access device fraud, 18 U.S.C. 1029, which covers selling, transferring, and possessing the data with intent to use it. Penalties reach 10 to 15 years in prison plus fines, and purchasing the list is a charge separate from using it.
State prosecutors add identity theft and computer fraud counts on top of the federal case. Buyers face a second risk: criminal markets are full of sellers who take payment and disappear, and some listings exist to collect the identities of the people who respond to them.
How do merchants detect enumeration attacks?
Decline patterns
Watch for a jump in code-mismatch declines spread across many different card numbers. Normal fraud produces a few declines on a few cards, not hundreds on unrelated accounts.
Velocity and BIN monitoring
Track attempts per card, per IP, and per BIN inside short windows. A cluster of low-value charges against one BIN in an hour is a clear signal.
Device and network signals
Reused device fingerprints, headless browsers, datacenter IP addresses, and billing data that does not match the card all point to automated testing.
Controls that stop the attack
- Attempt limits per card, per IP, and per session
- CAPTCHA or bot checks at checkout
- Required CVV and address verification on every card-not-present order
- 3-D Secure for higher-risk transactions
- Risk scoring that blocks the pattern, not just the single order
How can consumers protect themselves?
Most cardholders never see enumeration directly, but the same habits that limit card theft limit this scheme.
- Turn on transaction alerts for every charge, not just large ones.
- Use virtual card numbers for online stores so the real number stays private.
- Lock the card in the bank app when you are not shopping.
- Read statements each month and dispute unknown charges with the issuer. Federal law caps your liability for unauthorized use.
- Report fraud to the FTC at IdentityTheft.gov and to your state attorney general.
Frequently asked questions
Do CVV enumeration catalogs work?
Almost never for long. Issuers block cards after a few failed code attempts, and 3-D Secure stops most card-not-present orders that lack a second factor. The hit rates sellers advertise are not verifiable.
What happens if you buy one?
You commit a federal offense and you hand your payment details to criminals. Many buyers lose money to fake sellers and then face charges if the data is traced back to them.
How is a CVV different from the card number?
The card number identifies the account. The CVV proves the person has the physical card in hand. Enumeration attacks only the second part, which is why it depends on repeated guessing rather than a data breach.
Can a merchant store CVVs?
No. Payment card industry rules bar storing sensitive authentication data, including the CVV, after a transaction is authorized. Merchants keep a token or the last four digits instead.
Does a catalog mean my card was breached?
Not on its own. A card can end up in a catalog through a merchant breach, a skimmer, or a phishing page. If you see charges you do not recognize, call the number on the back of your card.