You suddenly have 400 new $1 trial signups. Sales are up, the approval rate looks great and, at first glance, the numbers seem worth celebrating.
Then, a month or two later, the chargebacks start rolling in. Cardholders begin disputing transactions they never made. Your chargeback ratio jumps, processing costs rise and your account starts receiving the kind of attention no high-risk merchant wants.
Passing one check does not make a transaction legitimate. A fraudster may have a stolen card number and billing address but not the CVV. Another may possess all three pieces of information but trigger a velocity rule after attempting dozens of transactions from the same device. Fraudsters generally seek the easiest checkout to exploit. Each additional layer makes fraudulent transactions harder to complete and the merchant less attractive to attack.
That’s because those 400 signups were never genuine customers; they were part of a card-testing attack. Fraud tools are designed to catch this activity before it becomes a chargeback problem, but no single filter catches everything. Address Verification Service (AVS), Card Verification Value (CVV), 3-D Secure and velocity checks each examine a different part of the transaction, so the strongest defense uses them together.
Here is how each layer works, where it falls short and how to combine them without turning away legitimate customers.
Why One Fraud Tool is Never Enough
Fraud prevention works best in layers because each tool answers a different question:
- AVS: Does the billing address match the issuer's records?
- CVV: Does the buyer have the security code printed on the card?
- 3-D Secure: Can the buyer authenticate the transaction with the issuing bank?
- Velocity checks: Does the activity surrounding the transaction look normal?
Passing one check does not make a transaction legitimate. A fraudster may have a stolen card number and billing address but not the CVV. Another may possess all three pieces of information but trigger a velocity rule after attempting dozens of transactions from the same device. Fraudsters generally seek the easiest checkout to exploit. Each additional layer makes fraudulent transactions harder to complete and the merchant less attractive to attack.
AVS: Does the Address Match?
AVS compares the billing information entered during checkout with the cardholder information held by the issuing bank. It typically checks the numeric portion of the street address and the ZIP or postal code, then returns a response indicating a full match, partial match, no match or unavailable result.
An AVS mismatch deserves a closer look, but do not decline a transaction based on that result alone. The customer may have moved recently, entered an old billing address or used a prepaid card. International cards can also return incomplete or inconsistent responses, so weigh the AVS result alongside the other information available.
CVV: Is the Card In Their Hands?
CVV is the security code on a payment card, usually a three-digit number on the back or, for American Express cards, a four-digit number on the front. It is particularly useful for card-not-present transactions because PCI DSS prohibits merchants from storing CVV data after authorization. Criminals who obtain card numbers and expiration dates from a compromised database may not have the code needed to complete checkout. Although phishing, physical theft and other forms of credential theft can expose it, requiring CVV can still stop some fraudulent attempts before they reach the next layer.
3-D Secure: Can They Prove It's Them?
3-D Secure, commonly called 3DS2, allows the issuing bank to evaluate the buyer and transaction. Many purchases pass through without additional steps, while higher-risk activity may trigger a one-time code or banking-app confirmation. One reason to use 3-D Secure is that it can put liability for certain fraud-related chargebacks on the card issuer. Do not assume you will receive that protection, though. It depends on how your account is classified, and some high-risk codes, including MCC 5967, are excluded. Your processor can tell you where your account stands.
Here's the tradeoff: 3-D Secure can slow down checkout. If the bank asks for a code or app approval, some customers will simply abandon the purchase. In Europe, you may not have a choice because Strong Customer Authentication rules often require that extra step. In the U.S., it usually makes more sense to rely on AVS, CVV and velocity checks instead, since 3-D Secure isn't required and many cards aren't enrolled.
Velocity Checks: Is This Normal Behavior?
Velocity checks examine how often an activity occurs rather than judging an isolated transaction. Merchants can limit attempts from one card, transactions from one IP address, signups from the same device, accounts created with one email address, or repeated failed payments.
These controls are especially effective against card testing. Criminals use automated tools to test lists of stolen payment credentials, often through inexpensive products, subscriptions, donations or trial offers.
That makes adult and other high-risk merchants with low-dollar introductory offers attractive targets. One $1 signup may look harmless, but hundreds of rapid attempts from the same device or IP address tell a different story.
Building a Layered Fraud Defense
Putting these tools into practice starts with enabling AVS and CVV for every card-not-present purchase, then confirming how your gateway responds to the results. Some gateways flag and record mismatches without automatically declining the sale. Not every mismatch warrants the same response. An incorrect CVV may justify an immediate decline, while a partial address match is less definitive. Legitimate customers may mistype information, move without updating their records or enter an address that differs slightly from the one on file.
The next step is tailoring 3-D Secure and velocity rules to your customers and business model. A subscription business may need to monitor repeated attempts on the same card, while several trial accounts created from one device or IP address may signal an attack. Customer location should also guide the use of 3-D Secure, while CAPTCHA and email verification can create additional barriers for card testers. Review fraud and decline data regularly to identify legitimate customers being blocked, attacks slipping through and changes in fraud patterns. The goal is to stop fraudulent purchases without unnecessarily rejecting good customers.
What Fraud Tools Won't Stop
AVS, CVV, 3-D Secure and velocity checks can identify unauthorized or suspicious transactions, but they cannot prevent every chargeback. Friendly fraud occurs when a legitimate cardholder makes a purchase and later disputes it. The customer may not recognize the billing descriptor, forget about a subscription or find it easier to dispute the charge than to contact the merchant.
Recognizable billing descriptors, accessible cancellation options and chargeback alerts can reduce that risk by giving merchants a chance to resolve eligible disputes before they are finalized. For high-risk merchants, preventing fraudulent transactions and managing the disputes that still arise are equally important parts of protecting an account.
Build for Your Risk
Do not copy another merchant's fraud settings and assume they will work for you. A site built around $1 trials will attract different attacks than a store selling expensive products, so the same rules could miss obvious fraud on one site and reject good customers on the other.
Stack the tools, watch the numbers and revisit your settings often. If signups suddenly explode, wait before uncorking the champagne. Make sure you are looking at real customers, not a card tester handing you a pile of next month's chargebacks.
