Start with the pick, then compare
If you want one answer, choose a virtual card number service that issues a fresh 16-digit number and a matching CVV for each merchant, with a spending cap you control. That setup contains the damage: a code exposed in one breached checkout cannot be reused anywhere else. Carding, the practice of testing stolen card numbers and CVV codes against live merchants, is a crime, and this guide does not cover it. Everything below is about defensive tools for shoppers and for merchants that accept cards online.
What to look for in CVV and CVC protection
- Number generation per merchant or per transaction, not one static number reused everywhere
- Merchant lock, so the number and its CVV only work at the store you assigned
- Spending caps per transaction, per merchant, and per month
- Instant freeze and real-time alerts on every authorization attempt
- Dynamic CVV that rotates on a schedule or per transaction
- Merchant side: CVV verified during authorization and never written to a database
- Clear dispute path, with chargeback support handled by the provider
Parameter bands that separate strong tools from weak ones
- Code lifetime: per transaction and under 1 hour is strongest; per merchant and unlimited is acceptable; a static printed code is the weakest
- Spend ceiling: a per-transaction limit you can edit beats a fixed monthly limit
- Authentication: a step-up challenge such as 3-D Secure on high-risk orders adds a second layer beyond the code itself
- Token support: network tokenization replaces the account number in transit, which shrinks the exposure window
- Recovery: same-day card replacement and a named human on support matter more than a long feature list
The options, in order
1. Merchant-locked virtual numbers
The top pick for most shoppers. You generate a number, assign it to one store, set a cap, and the CVV only validates there. Recurring subscriptions still work because the merchant is fixed.
Buying Card Security for Online Purchases: A Practical Guide
2. Dynamic CVV cards from your issuer
Some banks put a small display or app button on the card that refreshes the code every few minutes. The card number stays the same, so this helps against code theft but not against number theft.
3. Hosted payment fields with tokenization for merchants
If you sell online, never let card data touch your servers. Hosted fields pass the number and CVV straight to your processor, which returns a token you can reuse for refunds and repeat charges.
Best CVV to Buy for Carding: A Comprehensive Guide
4. Single-use numbers for trials
Good for one-off purchases and free trials you intend to cancel. Weak for anything you plan to keep, since the number dies after one authorization.
Pitfalls to avoid
- Any service advertised for carding, CVV testing, or card checking. Using it is fraud, and the data offered is usually stolen or fake
- Anyone who asks for your full card number and CVV by email, chat, or phone
- Storing CVV data after authorization, which PCI DSS prohibits
- Assuming a virtual number hides your billing address or name from the merchant
- Treating a virtual card as a substitute for reviewing statements
FAQ
Is using a virtual card number legal?
Yes, when it is tied to your own account and used for your own purchases.
Can a merchant keep my CVV after the sale?
No. Payment card industry rules bar storing sensitive authentication data, including the verification code, once a transaction is authorized.
Does a rotating CVV stop all fraud?
No. It narrows one attack path. Number theft, account takeover, and phishing still need separate defenses.
What if a store asks for the CVV over email?
Decline and shop elsewhere. No legitimate checkout needs the code outside an encrypted payment form.