Short answer
"CVV test 2026 v9" is a label attached to lists of card numbers and three-digit codes posted on forums and chat channels. Sellers describe the lists as a way to check which cards are live. The numbers in them are stolen or invented. They do not pass authorization at a real merchant. Running them through a payment page is card fraud, not testing.
Legitimate card testing uses sandbox credentials issued by a payment processor. Those numbers never reach a card network.
What a CVV is
The CVV is a 3-digit code on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The code is printed on the plastic and is not stored in the magnetic stripe. Card networks require it for card-not-present charges. It exists to show that the person typing the number holds the physical card.
CVV Test 2026 V7 Guide: How to Buy CVV Online Safely
A merchant cannot verify a CVV without sending an authorization request to the issuer. There is no offline check. A file that claims to hold valid CVVs has no way to confirm them outside the issuer system.
Why the lists fail
- Issuers block flagged cards within hours of a test run.
- Authorization requests carry the merchant ID and the IP address of the sender. The issuer sees both.
- Most list sellers resell the same records to many buyers.
- Fraud rules and chargebacks close the merchant account before the list is used up.
Legal status in the US
18 U.S.C. 1029 covers access devices. The term includes card numbers, CVVs, and account credentials. Producing, selling, or using a counterfeit access device carries up to 10 years for a first offense and 15 years for a second. 18 U.S.C. 1028A adds a mandatory 2-year term when identity theft is tied to the offense.
Offering CVVs for sale is a 1029(a)(3) offense by itself, even when no card is charged.
How legitimate testing works
- Open a sandbox account with a processor such as Stripe, Adyen, or Braintree.
- Use the published test card numbers. Stripe lists 4242 4242 4242 4242 with any future expiry date and any 3-digit CVV.
- Trigger decline codes with the documented test numbers for insufficient funds, expired card, and CVV mismatch.
- Log the response codes. Do not log the card data.
- Keep live card data out of the test environment. PCI DSS scope rules apply to both.
Signals of a CVV test scam
- The seller asks for gift cards, crypto, or chat app credits.
- The proof screenshot shows a dashboard with no merchant name.
- The price drops after the first offer.
- The seller advertises a "2026 v9" build. Cards do not ship in releases. Version numbers on card data mean nothing.
If money was already sent
Report the loss to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. A card issuer will not reverse a payment made to a CVV seller. Contact the issuer if your own card data was exposed.