The short answer
CVV fraud detection is a check that runs at authorization. The payment system compares the 3 or 4 digit code from the card with the value the issuer holds on file. A mismatch declines the order or moves it to review. A match clears one signal. It does not clear the sale.
What the code is
Visa, Mastercard and Discover print 3 digits. American Express prints 4. The value sits on the card face. It is not encoded in the magnetic stripe and not written to the chip. Issuers keep a second value tied to the chip and a third tied to contactless taps, so a code copied from an online order fails at a terminal.
Checks that run with it
- Address Verification Service: compares billing street number and ZIP against issuer records. Codes run from full match to no match.
- BIN country against IP country and shipping country.
- Velocity: attempts per card, per IP, per device inside a 1 hour or 24 hour window.
- Failure pattern: repeated CVV failures on one card, or one card testing many merchants.
- Session data: new device, proxy exit node, emulator flags.
Rules merchants set
Authorization returns three states: match, no match, not present. A merchant can decline on no match, hold the order, or accept it with extra checks. A common rule blocks a card after 1 to 3 CVV failures in 24 hours and sends it to manual review.
Where it stops
The check blocks a card number taken from a database that never held the code. It does not block a code read from the card by someone holding the card. PCI DSS bars storage of the code after authorization, so a breach at a compliant merchant should not expose it. Card networks still run chargeback monitoring programs for merchants that pass the check and ship fraud.
What to measure
Track the decline rate on no match, the share of orders sent to review, and the chargeback rate by channel. A rule that cuts fraud and also cuts approvals by the same amount has moved risk, not removed it.