Short answer
CVV fraud procedures run in four steps. The cardholder or the issuer spots a charge that used the card verification code. The issuer freezes the card and opens a dispute. The merchant or its acquirer answers a chargeback. The cardholder pays a capped amount or nothing. Because merchants may not store the code after authorization, a leaked CVV points to a breach at the point of capture or to a card-not-present merchant.
This guide covers detection, dispute, and recovery. It does not cover how to obtain or use card data. That is a federal crime in the US.
What the code is
Visa calls it CVV2. Mastercard calls it CVC2. American Express calls it the CID. Visa and Mastercard print 3 digits on the back, next to the signature panel. American Express prints 4 digits on the front. The code proves the buyer holds the physical card. It carries no account data.
Top Pick: CVV Fraud Prevention Rules Guide
Step 1: detection
Detection comes from three sources. The cardholder sees an unknown line on a statement. The issuer's fraud model flags an order with mismatched address data. The merchant's processor returns a CVV mismatch result, which in the US is a decline, not a fraud report. A cardholder who spots the charge calls the number on the back of the card. The clock for limited liability starts at discovery, not at the charge date.
Step 2: hold and reissue
The issuer closes the compromised card number and mails a new card with a new code. Closed accounts stop new authorizations within minutes in most cases. Recurring billing tied to the old number fails until the cardholder updates it. The issuer sends a dispute form and, in some cases, a written affidavit. Federal Reserve Regulation Z covers credit cards. Regulation E covers debit cards, and its deadlines are shorter.
Step 3: chargeback
The issuer files a chargeback with the card network. Visa and Mastercard route it to the merchant's acquirer. The merchant has a set window to answer with proof: address match, code match result, delivery signature, IP address, device fingerprint. Visa reason code 75 covers a cardholder who does not recognize a transaction. Mastercard reason code 37 covers no cardholder authorization. If the merchant rebuts, the case moves to pre-arbitration, then arbitration, and the losing side pays fees.
Step 4: liability and reporting
US law caps credit card liability at $50 for unauthorized use under 15 U.S.C. § 1643. Many issuers waive the $50. Debit card liability is $50 if the cardholder reports within 2 business days, $500 if later, and uncapped after 60 days from the statement date. Reporting channels: the issuer's fraud line, the FTC at IdentityTheft.gov, and the FBI's IC3 for wire loss. A police report helps an identity theft case. It does not start a chargeback.
What merchants must not do
PCI DSS Requirement 3.2 bars storage of the CVV, the full magnetic stripe track data, and the PIN block after authorization. Storage of those fields, even in encrypted form, puts a merchant outside the standard. The code must not appear on receipts, in order notes, or in a customer database.
Legal exposure
18 U.S.C. § 1029 covers access device fraud, which includes trafficking in card numbers and verification codes. Some counts carry up to 15 years. 18 U.S.C. § 1028 covers identity documents. Buying or selling card data is a federal crime in the US, and card-data marketplaces are a target for law enforcement stings.