Buy this first: a PCI DSS Level 1 gateway that checks CVV/CVC at authorization and tokenizes the card number
For an online store, the right purchase is not a "CVV source." It is a payment security stack from a provider certified PCI DSS Level 1 that verifies the CVC value in real time during authorization, replaces the card number with a token before it reaches your servers, and gives you fraud rules and chargeback evidence in the same dashboard. That single bundle covers the three jobs merchants actually need: blocking stolen-card attempts, shrinking compliance scope, and winning disputes. Everything below explains how to compare those providers and where cheap alternatives fall apart.
One thing to settle first. There is no legal market for buying CVV, CVC, or CVV2 values. Those digits exist to prove the buyer physically holds the card. Buying, selling, or trading them is card fraud in the United States and most other countries, and the data sold on underground markets is often stolen, stale, or fabricated. If a site offers to sell you card verification codes, that is a crime, not a vendor. The rest of this guide covers what you can legally buy to protect CVC data on your own checkout.
What to look for
- Verification at the point of authorization. The provider should send the CVC check to the issuer in the same authorization message, not store it for a later manual review.
- Tokenization coverage. Confirm the token replaces the card number for one-time charges, stored credentials, subscriptions, and refunds. Partial coverage creates a gap you will pay for later.
- 3-D Secure support, including exemptions. Look for protocol version 2.2 or newer and support for low-value and transaction-risk-analysis exemptions so you are not forcing a challenge on every sale.
- Written retention policy. Sensitive authentication data, which includes the CVC, cannot be kept after authorization. Ask for the clause in the contract, not just a sales page claim.
- Current attestation evidence. Request the provider's Attestation of Compliance and its most recent quarterly network scan summary.
- Fraud rule engine. Velocity checks, mismatched billing and shipping country, device fingerprinting, and custom rules your team can edit without opening a support ticket.
- Chargeback tooling. Dispute alerts, reason-code mapping, and a workflow for submitting evidence before the response deadline.
- Pricing structure. Per-transaction rate, monthly gateway fee, tokenization fee, 3-D Secure authentication fee, and chargeback fee should all be listed in the quote.
Parameter bands worth comparing
Numbers vary by provider and volume, but these ranges separate a production-ready service from a starter plan.
- Uptime commitment: 99.9 percent or better, with service credits written into the agreement.
- Added authorization latency: under 300 to 500 milliseconds. Anything slower shows up as abandoned carts on mobile.
- Compliance refresh: annual re-attestation plus four passing quarterly scans per year.
- Chargeback ratio: keep your own ratio well under the monitoring thresholds the card networks publish, which generally begin near 1 percent of transactions. Once you cross into a monitoring program, fees and reserves follow.
- Support response: 24/7 coverage with a named contact and a severity-one response target measured in minutes, not business days.
- Integration: a documented API, hosted fields or an iframe so raw card data never touches your page, and a sandbox with test decline codes.
Where buyers go wrong
- Choosing a vendor that advertises "CVV storage" or "CVC vaulting." That practice is prohibited, and a provider offering it is telling you it does not follow the standard.
- Using a free checkout plugin that posts card data through a third-party server you cannot audit. That moves the breach risk onto you and can void your merchant agreement.
- Assuming 3-D Secure eliminates chargebacks. It shifts liability for covered transactions but does not stop friendly fraud on exempt ones.
- Ignoring the chargeback ratio until a network notice arrives. By then you are paying non-compliance assessments and posting a reserve.
- Buying on price alone. A gateway that saves a few basis points per transaction but fails an authorization windows test will cost more in lost sales.
FAQ
Can I store CVC values to cut down on declines?
No. Card verification data is classified as sensitive authentication data and cannot be retained after authorization, even encrypted. Repeat customers should be handled with network tokens or stored-credential frameworks that the card networks manage.
What does a CVC check actually prove?
It confirms the code matches what the issuer has on file, which suggests the person knows the card details. It does not prove the person is the cardholder, so treat it as one signal among several.
Is 3-D Secure mandatory in the United States?
Not universally. Many US merchants run it selectively and apply exemptions to low-risk orders. The rules differ by market, so check the current requirements for each country you sell into.
Do I need tokenization if I never store card numbers?
It still helps. Tokens reduce the scope of your compliance audit and let you process subscriptions and refunds without touching the original number.
How should I compare quotes?
Build a total cost per hundred transactions using your own mix of domestic, international, 3-D Secure, and exempt orders. That figure is the only one that lets you rank providers fairly.