Testing a CVV on a UnionPay card you do not own is carding, and it is a federal crime in the United States under 18 U.S.C. § 1029. There is no legal route to "test" card numbers that belong to other people. Merchants verify CVVs through licensed payment processors, and those checks run inside an approved payment environment.
Related UnionPay CVV Test Online: A Guide
What is a CVV on a UnionPay card?
UnionPay calls its card verification value CVN2. It is a 3-digit code printed on the back of the card, next to the signature panel on most UnionPay credit cards. The issuer generates it at the same time as the card number, and it never appears on a receipt or in the magnetic stripe data.
How is CVN2 different from a PIN?
A PIN authorizes the cardholder at a terminal or ATM. CVN2 proves the buyer holds the physical card during a remote purchase. Neither value is a password you can guess or brute-force, because the issuer validates it against its own records at authorization time.
synonym unionpay cvv verification check
How do merchants verify a CVN2 the right way?
A merchant never "tests" a card. The merchant asks the issuer one question: does this CVN2 match this card number? The answer comes back as a match, no match, or not processed.
- Open a merchant account with an acquirer that supports UnionPay acceptance.
- Send the card number, expiry, and CVN2 to the processor over an encrypted channel at the moment of sale.
- Read the authorization response and approve or decline the order.
- Discard the CVN2 after authorization. PCI DSS Requirement 3.2 forbids storing sensitive authentication data once the transaction is complete.
That is the whole process. There is no separate "CVV test" step, and no legitimate processor offers one.
Why do "CVV checker" tools and bulk test services exist?
Tools that promise to validate card data in bulk serve three purposes, and none of them help the buyer. Some take payment and return random results. Some log the IP address and device fingerprint of every visitor. Some are run by fraud units that hand the logs to law enforcement.
Issuers also watch for the pattern. A string of small authorizations on one card, or many cards tested from one device in a short window, triggers velocity rules and account blocks. Card networks share that data across issuers.
What are the penalties under US law?
18 U.S.C. § 1029 covers the production, sale, and use of access devices such as card numbers and CVVs. A first offense carries up to 10 years in prison, and the ceiling rises to 15 years when the case involves 15 or more cards or $1,000 in value within a year.
Federal prosecutors often add aggravated identity theft charges. That count adds a mandatory 2-year sentence that must run consecutive to any other term. Fines can reach $250,000 for an individual.
What should you do instead?
- If you run a store: talk to your acquirer about UnionPay acceptance and follow the PCI DSS rules for handling card data.
- If you build payment software: use the sandbox test card numbers your processor publishes. Those numbers are synthetic and safe to submit.
- If a charge hit your account: call your card issuer, then file a report with the FTC at ReportFraud.ftc.gov and with the FBI's IC3.
- If someone offered to sell you card data: walk away and report it. Buying the data is a separate crime from using it.
Frequently asked questions
Does UnionPay use CVV or CVN2?
UnionPay uses the term CVN2 for the 3-digit code on the back of its cards. It works the same way as a CVV2 on Visa or a CVC2 on Mastercard.
Can you test a CVV without charging the card?
Only inside a processor sandbox using test card numbers the processor supplies. A zero-dollar or one-cent authorization against a real card is still an authorization attempt and still leaves a trace.
Is buying CVV data legal in the US?
No. Purchasing stolen card data violates 18 U.S.C. § 1029, and intent does not need to involve a completed purchase to support charges.
What happens to a card after a failed CVN2 check?
The issuer may decline the transaction, flag the account, or both. Repeated mismatches on one card number usually lead to a block and a review by the issuer's fraud team.
The short version
CVN2 verification is a function of the issuer and the payment processor, not a service you can run yourself. Any site that sells "CVV testing" is either a scam, a honeypot, or both. Merchants who need to accept UnionPay cards should go through an acquirer, and anyone who finds unauthorized charges should contact their issuer and file a report.