15

I have a Visa debit card that I use mainly for travel (it has low FX fees).

The other day I received loads of notifications from the corresponding app: 2 with 'The CVV was incorrect', followed by 4 with 'The CVV was entered incorrectly too many times'. Most of these were for £0, one was for £1. The seemed to come from some pub in England in a town I had never been to. There was also one transaction right after in the US (for 0$, also declined), and another for 6$ in the US.

I have of course frozen the card right away, but I don't understand what the scammers were trying to do here. If they had cloned the card when I used it on my travels they would have had the correct CVV. Is this just some bulk attack where they try huge numbers of card numbers with random CVVs hoping to get some correct (given that CVVs are quite short?)?

4
  • 13
    I am not 100% sure of this but I don't believe the CVV is encoded on the barcode on the cards, so if they clone it using a swipe, it won't have the CVV so they would try to "guess" it so it can be associated with it and used, and like you said 3 digits the combinations are not that high so they might try and brute force it. That's just a guess. Commented Dec 10, 2023 at 19:21
  • I almost always used the card via Apple Pay. The card itself has almost never been used directly - maybe just to take cash out once. I wonder if card numbers may be also randomly sampled? Or would the attackers need to at least know the card number? An automated opportunistic attack seems more likely to me.
    – rinspy
    Commented Dec 10, 2023 at 21:48
  • 2
    @GµårÐïåñ There are two CVV. CVV1 is encoded in the magnetic stripe (there's no barcode on CCs). CVV2 is written on the card. Commented Dec 11, 2023 at 2:34
  • 3
    I apologize for the ambiguous use of "barcode" but what I meant is the magnetic strip on the back, I believe most people got that. Commented Dec 11, 2023 at 3:02

2 Answers 2

14

Given how low the transaction amounts were, they may have been trying to see whether the CVV was valid. If the first transaction goes through, then they would have tried a larger one.

I have of course frozen the card right away, but I don't understand what the scammers were trying to do here. If they had cloned the card when I used it on my travels they would have had the correct CVV.

There are two CVVs. CVV1 is encoded in the magnetic stripe. CVV2 is written on the card. CVV1 is used for Card Present transactions, so presumably that would be the one used. In a swipe transaction, the CVV1 is read off the magnetic strip, and in a chip transaction the CVV1 is part of the encoded transaction data. So the leading hypothesis in my mind is that "CVV" is for some reason being used to refer to the PIN. I suppose that someone might have been trying to do a Card Not Present transaction, but that would be a weird thing to do. It is sometimes an option if something is wrong with the POS, but it's definitely discouraged.

Is this just some bulk attack where they try huge numbers of card numbers with random CVVs hoping to get some correct (given that CVVs are quite short?)?

That's certainly a tactic used; if you can get a million credit card numbers, then having only 1/1000 CVV be correct still leaves you with a thousand valid CC. But that's more of an online tactic. It's not so practical at a physical location.

10
  • 3
    The transactions are not necessarily coming from a physical location, it could be some kind of attack on the pub's payment processing system, used specifically for testing CVVs without exposing who is doing it.
    – jpa
    Commented Dec 11, 2023 at 7:51
  • Do magnetic stripes still exist?
    – gerrit
    Commented Dec 11, 2023 at 7:57
  • 4
    Very unlikely transactions were made from the physical locations - within a few seconds there were 5 transactions in the UK and 2 in the US.
    – rinspy
    Commented Dec 11, 2023 at 10:27
  • @gerrit All my cards still have magnetic stripes. The US didn't adopt chips until 2015, and I suspect magnetic stripes will stick around for quite some time.
    – MJD
    Commented Dec 11, 2023 at 15:45
  • 2
    It's not 1 in 1000. It's however many tries they get before triggering a lockout in 1000. Commented Dec 12, 2023 at 2:04
6

The CVV is printed on the physical card. It isn't on the chip or the magnetic strip.

seemed to come from some pub in England in a town I had never been to.

It is entered into the system when the card is not physically present. If you use the card at the pub, they don't need to enter the CVV. If it is being used online, or you are giving the number over the phone, the CVV is required. In your question the card number, expiration date and the CVV are being entered because the person is trying to purchase something online.

The credit card network is blocking the transaction because of too many wrong numbers being entered.

Most of these were for £0, one was for £1.

I think the small transactions are pending transactions. This occurs typically at a gas station, or a restaurant but it could be almost any transaction. They place a hold for a small transaction until the transaction is finalized.

'The CVV was entered incorrectly too many times'

This means that the card is blocked. It could be permanently blocked, or it could become usable once a period of time has passed. If it was due to a typo, it would be nice to have it automatically unlock; but if was a fraud attempt it would be nice to keep it blocked.

Contact the card company to see what the next step is. They might give you a new number.

11
  • 2
    @shoover this makes no sense. If they're using the magnetic strip or the chip, the printed cvv should never be used.
    – littleadv
    Commented Dec 11, 2023 at 0:01
  • 1
    "The CVV is printed on the physical card. It isn't on the chip or the magnetic strip." That is false. There are two CVV. CVV1 is encoded in the magnetic stripe. CVV2 is written on the card. Commented Dec 11, 2023 at 2:35
  • 2
    I think the small transactions are pending transactions. This occurs typically at a gas station, or a restaurant but it could be almost any transaction. They place a hold for a small transaction until the transaction is finalized. In my experience, the hold is for as high a transaction as could reasonably be expected - e.g., $100 (saw $200 recently!) for a tank of gas, because you don't know until the transaction is done how much it will be, but you want to make sure before a drop of gas is delivered that there will be money to pay for it. Commented Dec 11, 2023 at 5:48
  • 2
    Small transactions are common when testing a stolen card to make sure it works before selling it Commented Dec 11, 2023 at 7:50
  • 1
    @shoover If they ask for a CVV they are using a device or contract which is designed for "card not present" transactions (phone or mail order). Using it when the customer is actually present is usually a breach of contract, they are required to use a device+contract designed for card present transactions, which will then use the chip (or, previously, the magnetic stripe). Asking for the CVV in such a setting makes them suspect.
    – jcaron
    Commented Dec 11, 2023 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .