> I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. You're

> I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. You're correct that almost all don't have three identical digits, but that's just because there's only 10 of them - 000, 111, 222, 333, 444, 555, 666, 777, 888, 999 10/1000 = 1% I doubt they would make up rules for determining the cvv, as it would only improve security until bad actors could determine the rules - then it would hinder security as there would be less entropy in the selection space.