If I'm not wrong, the CVV code almost always follows a certain pattern based on the credit card number and dates. What are the possibilities to go through to hypothetically brute-force a CVV code? Is an online attack possible?


3 Answers 3


Actually it was possible, at least for Visa cards. There was no per-card lockout across the entire network, so by hitting different payment processors (to prevent from reaching any brute force limit they might have) you could brute force a CVV2. I am not sure whether this is still possible, I would expect (and hope) that Visa implemented network-wide protections against this.


If I'm not wrong, the cvv code almost always follows a certain pattern

No you are wrong, it could be completely random, 3, 4 or n chars.

After some failed activity with the card(could be 3, 5 etc...), it will be disabled. Plus you need to provide captcha for every request.

Sounds like you are much into hack rather security. A hacker at first is a great security geek.


No. It is not possible Cryptographically brute force. CVV generation uses one round DES and one round Triple-DES encryption and then first 3 numeric digits are selected from output(decimalization). As strong cryptographic algorithms are used for generation it is not possible to brute force CVV Cryptographically. Refer to my answer : https://stackoverflow.com/a/59116013/6225803

Yes. CVV generation being lossy encryption which produces 000-999 values. If you can make 1000 attempts and issuer does not block card after defined failed attempts.

  • 1
    The keyspace of 1000 is incredibly small and if I say the CVV printed on your card is 269, there is a chance that someone reading this will be surprized that I guessed their CVV correctly.
    – user163495
    Nov 30, 2019 at 12:50
  • @MechMK1 Only guessing cvv is not sufficient, you need to guess cardno, expiry and usually pin/otp to successfully complete a transaction. Nov 30, 2019 at 12:55
  • Yes, that is usually correct, although you may be in a situation where these are known and only the CVV is not.
    – user163495
    Nov 30, 2019 at 12:58
  • 1
    According to this answer, it at least used to be possible. If no measures are in-place to prevent further attempts (which is also a problem, as you can effectively disable a card like that), you can spread your attempts over different stores and sites. If you have 3 attempts per store, then you are likely to succeed after 150 stores. Quite a lot, though it may still be worth it.
    – user163495
    Nov 30, 2019 at 14:59
  • 1
    @krishnaTelgave well, if you have 10000 stolen card numbers, then trying (for example) 269, 270 and 271 as CVV for all these cards will most likely result in approximately 300 successful guesses.
    – Peteris
    Dec 2, 2019 at 11:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.