What does a card validator CVV test check?
A card validator checks structure, not account status. It runs the Luhn (mod-10) checksum, confirms the length and BIN range match a known issuer format, and verifies the CVV is 3 digits, or 4 digits for American Express. A pass means the number is well-formed and nothing more.
Card BIN Checker Test: Buying Guide for Accurate BIN Validation
A validator cannot see balances, holds, expiration status, or whether an issuer will approve a charge. Only an authorization request to the issuer answers that question.
Checkout CVV Test: How to Verify Card Security Code Handling
How does the Luhn check work?
Luhn doubles every second digit from the right, sums all digits, and requires the total to be divisible by 10. It catches typos and single-digit transpositions, which is why most mistyped numbers fail immediately. It says nothing about whether the card is active.
How many digits is a CVV?
Visa, Mastercard, and Discover print a 3-digit CVV2 near the signature panel. American Express uses a 4-digit code on the front of the card. A weak validator that checks only digit count will accept 000, which is why format checks alone are not a security control.
How do you test CVV validation without real card numbers?
Use the sandbox numbers your payment processor publishes. Stripe, Adyen, and most gateways issue test PANs with fixed expiry and CVV values that trigger specific outcomes such as approve, generic decline, or CVV mismatch. Those numbers are created for testing and are never tied to a live account.
What should a test plan cover?
- Valid Luhn with a correct-length CVV, expected to pass
- Valid Luhn with a 2-digit CVV, expected to fail
- Invalid Luhn with a correct-length CVV, expected to fail
- Spaces, letters, and pasted whitespace in the CVV field
- American Express 4-digit CVV against a 3-digit input mask
- Leading zeros and numeric-only input on mobile keypads
Is it legal to test card numbers you do not own?
No. Sending real card numbers you do not hold to a validator, checkout page, or donation form is card testing, and in the US it falls under access device fraud and computer fraud statutes. Even a one-dollar authorization attempt without the cardholder's permission is a crime. Processors log the pattern and report it.
Buying or selling card data is a separate federal offense under 18 U.S.C. 1029. No legitimate tool, guide, or service sells working CVV data, and any site claiming to does not have real cards.
Why does bulk CVV testing fail?
Testing stolen numbers in bulk is how fraudsters filter lists before resale, and it produces bursts of small authorizations at odd hours. Issuers score those bursts with velocity rules, BIN-level limits, device fingerprinting, and IP reputation, so most runs get blocked and the cards get reissued. The cardholder disputes the attempts, and the merchant absorbs the chargeback fees.
What does PCI DSS require for CVV handling?
PCI DSS forbids storing the CVV2 after authorization, even in encrypted form. Sensitive authentication data must be purged once the transaction completes, so a compliant validator never writes the CVV to a log or database. Any tool that stores CVVs is out of compliance by design.
Can a validator tell if a card is live?
No. Liveness requires an issuer authorization, and that requires cardholder permission. A validator that advertises live card checks is either reselling stolen authorization attempts or fabricating results.
Why does a validator reject a number that looks correct?
Common causes are a failed Luhn digit, wrong length for the BIN, mixed card brands in one field, or a CVV entered from the wrong side of the card. Re-entering the digits without spaces resolves most rejections.