Well, as you point out, the probability of not hitting a valid CVV this way is non-zero, or 0.672% - if using R: choose(5000,0)*0.999^(5000-0)*0.001^0 But

Well, as you point out, the probability of not hitting a valid CVV this way is non-zero, or 0.672% - if using R: choose(5000,0)*0.999^(5000-0)*0.001^0 But that means, by brute forcing, while you should crack at least one card, there is still a non-zero chance that this will be your unlucky day... (Cracking all cards with this methods, is - essentially - a zero-chance game, but even for that an infinitesimally small chance is left, that my computer cannot reproduce.)