When CVV doesn't match, I would always be very careful about accepting an order. What often happens in the cases of data theft is that fraudsters
will steal the financial information of x amount of individuals and then proceed to quickly use that information to make purchases online. The CVV though is only used to verify that the card is in the possession of the buyer and is not stored alongside the card number for record keeping specifically for security reasons. This is why when credit card numbers are stolen they often are unable to also steal the CVV numbers as well.
Shopify lets you determine if you want to accept orders with a failed CVV or not, but to truly understand if the order is real or not I would recommend fraud prevention software like Signifyd http://apps.shopify.com/signifyd The goal is to determine if all the other data elements (billing/shipping, IP address, is this an order in the normal price range of the card holder) is consistent to ensure if an order is legit or not.