CVV guessing does not work. A CVV is a 3-digit code on the back of a Visa, Mastercard, or Discover card. American Express uses a 4-digit code on the front. The code is random. It is not derived from the card number or expiration date. Card issuers limit the number of failed attempts. After a few tries, the card is blocked or the transaction is declined.

What a CVV is

CVV stands for Card Verification Value. It is a security feature for card-not-present transactions. Online merchants ask for the CVV to confirm that the buyer has the card. The code is printed on the card but not stored in the magnetic stripe or chip.

Why guessing fails

A 3-digit CVV has 1,000 possible values. A 4-digit CVV has 10,000 possible values. A random guess has a low chance of success. Payment networks also use rate limits and fraud scoring. Multiple failed CVV attempts trigger a block. The network may flag the card for suspicious activity.

Legal consequences

Buying, selling, or using stolen CVVs is illegal. In the US, 18 U.S.C. § 1029 covers access device fraud. Penalties include fines and prison time. The FBI investigates card fraud rings. The FTC advises consumers to report card fraud.

How merchants detect fraud

Merchants use address verification (AVS) and CVV checks. A mismatch between the billing address and the card on file can decline the order. Card issuers may require 3-D Secure authentication. PCI DSS rules prohibit merchants from storing the CVV after authorization.

How to protect your card

Keep your card in a safe place. Do not share the CVV by phone or email. Check your statements for unknown charges. Report lost or stolen cards to the issuer. Use virtual card numbers for online purchases when available.