CVV fraud control comes down to one habit: treat the three- or four-digit code as a single-use signal, never as a stored secret. You verify it at authorization, you don't write it down, and you wrap it with address checks, authentication, and velocity rules so a stolen card number alone can't push an order through.
What the CVV can and cannot prove
The code proves someone has the physical card in front of them at that moment. That's it. It says nothing about whether that person is the cardholder, and it says nothing about intent. Most card-not-present fraud I've seen involves complete data sets, CVV included, lifted from a skimmer or a breached merchant. If your only fraud control is a CVV match, you're checking that the thief copied all the fields correctly.
Top Pick: CVV Fraud Prevention Rules Guide
There's also a hard rule on the storage side. PCI DSS treats the CVV, full track data, and PIN blocks as sensitive authentication data, and you may not retain them after authorization, encrypted or otherwise. Any processor or plugin that offers to "save the CVV for repeat orders" is handing you a compliance problem.
The controls that carry the weight
CVV verification at the authorization step
Send the code with the authorization request and read the response code, not just the approved or declined flag. A CVV mismatch with a matching address is a different animal from a mismatch with a mismatched ZIP, and your rules should treat them differently.
Address Verification Service
AVS compares the numeric part of the billing street address and the ZIP against what the issuer has on file. It's blunt and it produces false declines on people who move often, but combined with CVV results it separates clean orders from suspicious ones fast. Domestic AVS is far more reliable than cross-border, so set thresholds per country instead of one global rule.
3-D Secure and risk-based authentication
EMV 3-D Secure kicks the cardholder to their issuer for a challenge when the risk warrants it, and skips the friction when it doesn't. In most markets it shifts chargeback liability for authenticated transactions, which matters more to your bottom line than the fraud rate alone.
Network tokenization
Tokens replace the PAN with a surrogate tied to a device or merchant. A stolen token is worth much less than a stolen card number, and the real PAN never sits in your database waiting for someone to find it.
Behavior and velocity signals
Look at the shape of the order, not just the fields. Card testing shows up as clusters of small authorizations from one IP or device fingerprint. A first-time customer buying three laptops and shipping to a freight forwarder is a different risk than a repeat buyer reordering the same item. Watch how many distinct cards one device tries in an hour, how many cards share one shipping address, and how often the email domain changes for the same customer record.
Stacking controls without killing conversions
Every control you add costs you some legitimate orders. The trick is to reserve friction for the cases that earn it. Let clean signals pass untouched, challenge the ambiguous middle with 3-D Secure, and only decline when several independent signals agree. Review your decline reasons monthly. If chargebacks are low and declines are high, you're not controlling fraud, you're just turning away sales.