What a CVV or CVC code does
A CVV is the 3-digit code on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The code does not sit in the magnetic stripe or the chip. It exists to show that the person typing the card number holds the physical card.
CVV Vendors on Dark Web List: A Comprehensive Guide
Why there is no honest ranking of dark web CVV sites
Sites that advertise stolen card data operate against the law. 18 U.S.C. 1029 covers the sale, transfer, and possession of card numbers and access devices. A first offense carries up to 10 years in prison and a $250,000 fine.
Dark Web CVV Shop Reviews: Safer Card Controls Compared
Those sites also fail as products. Card data has a short shelf life because issuers cancel compromised accounts. Many CVV shops take payment and deliver nothing. Some are run by law enforcement. A buyer who sends cryptocurrency has no recourse and no way to verify the seller.
So this comparison covers defenses that work. Pick the first item, then add the rest.
Pick this first: never type a card number into a page you cannot verify
Card-not-present fraud makes up the majority of US card fraud losses. The control with the largest effect is refusing to enter a card number into an unverified checkout page.
- Read the domain in the address bar. A padlock means the connection is encrypted. It does not mean the seller is honest.
- Pay through a wallet or a virtual card. The merchant never sees your real account number.
Options after that
1. Virtual card numbers
Issuers and card networks issue card numbers tied to one merchant. Set a spend cap and an expiry date. If the number leaks, the loss stops at the cap.
2. 3-D Secure authentication
3-D Secure adds a bank check at checkout. The bank sends a code or asks for a fingerprint. When authentication passes, fraud liability shifts to the issuer.
3. Card controls in the issuer app
Turn the card off when it is not in use. Set merchant category blocks. Set a per-transaction limit. These controls stop most card-testing attacks, where a fraudster runs small charges to check if a number is live.
4. Statement review and reporting
Read each statement. Report unknown charges within 60 days. Under the Fair Credit Billing Act, credit card liability for unauthorized charges caps at $50. Report identity theft at IdentityTheft.gov and file a complaint with the FBI Internet Crime Complaint Center.
What merchants must do with the code
PCI DSS Requirement 3.2 forbids storing the CVV after authorization. A store that saves the code is out of compliance. Ask any merchant that keeps card data on file how it handles the code, and ask for the compliance report.