If I am not wrong, visa is easy to guess cvv right?

Let's say if I have 100,000 credit card numbers and expiration dates, it is possible to make daily 5 guesses.

All cards with 5 the same gateway/Api of payment and cards will not get blocked due to multiple attempts?

If yes, then it's possible to create like 10 APIs and check them with 50 cvv attempts daily.

So, in the end, we get all 100,000 cards' cvv codes in 20 days (50 guesses 000-001-002 daily)?

  • 2
    It'll probably be extremely suspicious if the same card gets repeatedly rejected for random CVV numbers
    – MechMK1
    May 8 '20 at 12:17

According to this article it is indeed somewhat possible.

Researchers at Newcastle University in the UK recently decided to see just how effectively the second caveat [that the payment processor mustn’t allow too many guesses at your CVV] was enforced, by trying to guess CVVs. [...]

If each website gives you five guesses, then with 200 simultaneous guesses on a range of different websites, you can get through 1000 guesses (200 × 5) in quick order without triggering a block on any of the sites.

And with 1000 guesses, you can cover all CCV possibilities from 000 to 999, stopping when you succeed.

Then you can go to a 201st site and order just about whatever you like, because you’ve “solved” the CVV without ever actually seeing the victim’s card.

The article goes on to mention that credit card fraud is far from uncommon and guessing the CVV isn't the easiest way of doing that, which I believe is likely to be true.

Worth noting is that some cards (like American Express) use a 4-digit code.

  • Is there a list of issuing networks like amex using a 40-digits code?
    – aloisdg
    Sep 15 at 15:09
  • 1
    @aloisdg I'm not aware of any such list. I think Discover uses a 4-digit code as well, but I don't think anyone really maintains a list. There's a Payment Card Industry Data Security Standard (PCI DSS) and Payment Card Industry Security Standards Council (PCI SSC) that maintains it, so perhaps trying to find their documents can lead you somewhere. I don't think they see any value in openness to the public, though, so I'm not sure you will find much info. There aren't that many credit card operators, I think, so maybe just digging around the web could allow you to compile a list. Sep 16 at 15:25
  • 1
    First 4. It's 4 not 40 of course. For the list I will keep looking. For Discover, it is a 3-digits code as per discover.com/credit-cards/resources/credit-card-security-code
    – aloisdg
    Sep 16 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.