There is no legitimate place to buy CVV numbers online. Card verification values sold in bulk, in Telegram channels, or through automated "shops" come from stolen cards. In the United States, buying, selling, or possessing card data with intent to defraud falls under access device fraud statutes, and buyers face the same exposure as sellers. What follows is the practical version of this question: how to vet any site that asks you to enter a CVV, how to recognize a card-data shop for what it is, and what to do if your own CVV is already circulating.
How to recognize a card-data shop
These operations share a recognizable shape. They advertise "fresh" or "fullz" bundles with BIN-level pricing, run automated checkers that test numbers against live merchants, promise replacement guarantees on dead cards, and take payment in crypto with escrow handled by a forum moderator. Every one of those features exists because the inventory is stolen and the counterparties cannot use contracts or chargebacks. A guarantee from an anonymous seller is worth nothing, and buyers are routinely resold the same numbers. Treat any site with this profile as a fraud marketplace, not a vendor.
How to vet a merchant before you type your CVV
Run these checks on any checkout that requests the three or four digit code from your card.
- Confirm the address bar shows the merchant's own registered domain and a valid TLS certificate. A checkout hosted on an unrelated domain is a stop sign.
- Look for a privacy policy and refund policy that name the legal entity and a physical address. Missing policy pages correlate with card testing sites.
- Confirm the CVV field sits on a processor-hosted page or embedded frame, not a hand-coded form on the merchant's server.
- Check whether the site offers 3-D Secure verification through your issuer. Skipping it is normal in the US, but a site that blocks it is worth questioning.
- Generate a single-use virtual card number with a fixed limit and a short expiry, then use that instead of your primary card.
- Place a small first order. Wait for the authorization to settle before returning with a larger purchase.
- Confirm the receipt shows only the last four digits of the card. A receipt listing the full number or the CVV is a data handling failure.
Parameters that separate a safe checkout from a risky one
- TLS version and certificate validity for the payment page itself, not just the homepage.
- Whether the CVV is required on every transaction or can be waived for stored cards.
- Whether card data passes through the merchant's servers at all, or goes directly to the processor.
- Chargeback and dispute contact details published before purchase, not buried after.
- Whether the merchant accepts recognizable payment methods with recourse.
Pitfalls to avoid
- Any request to send a CVV by email, chat, or phone. No legitimate merchant needs it outside a payment form.
- Sites that ask for the CVV a second time to "verify" an order after checkout. That is card testing.
- Prices far below market on high-demand goods, used to harvest card details at checkout.
- Sellers who insist on crypto with no escrow, no identity, and no dispute path.
- Forms that place card fields on a page served over plain HTTP or from a third-party script.
What to do if your CVV is already exposed
- Call the number on the back of your card and report the exposure.
- Ask the issuer to freeze the card and issue a new number, including a new CVV.
- Dispute any charge you do not recognize in writing, and keep the reference number.
- File a report at the FTC's identity theft resource and keep the confirmation.
- Review statements for the next two billing cycles, since test charges often precede larger ones.
Shopping for card numbers is a way to become a defendant and a victim at the same time. Vetting the merchant, limiting exposure with virtual numbers, and acting fast when a CVV leaks are the only moves that pay off.