What a CVV is
The CVV is the 3-digit code on the back of a Visa or Mastercard. On American Express it is a 4-digit code on the front. The code confirms that the person using the card holds the card. Under PCI DSS, a merchant passes the CVV to the processor during authorization. The merchant does not store it after the response.
Bulk CVV offers: two outcomes
Listings that offer card data by the hundred at a low unit price fall into two groups. The first group sells stolen numbers. Federal law covers this group. 18 U.S.C. § 1029 makes trafficking in access devices a crime, and the statute applies to the buyer as well as the seller.
The second group is larger. The seller holds no card data. The seller takes payment, then asks for more, or keeps the buyer's identity and uses it. A buyer in this position has no recourse. A loss cannot be reported without describing the purchase.
Where to Sell CVV Cheap Price: A Complete Buying Guide
Numbers sold in volume also go stale. An issuer blocks and reissues a card after a fraud report. A batch loses valid entries as it circulates, so the stated count and the usable count differ.
Checks on any card data offer
- Legitimate card data is not sold. Acquirers and processors move card data under contract, not through public listings.
- Payment in crypto or gift cards to an unknown seller is a loss with no dispute path.
- Requests for a photo of a card, a bank login, or an ID scan serve identity theft, not verification.
- No test transaction proves a batch is live. A test charge is itself an unauthorized charge.
Steps for shoppers
- Give the CVV only on a checkout page. Do not send it by email, chat, or phone.
- Use a virtual card number for new or small merchants. Set a spend limit.
- Read the statement each month. Report unknown charges to the issuer on the day you find them.
- File a report at IdentityTheft.gov and at the FTC if a charge is not resolved.
Steps for merchants
- Send the CVV to the processor for authorization. Do not write it to a database, a log, or a ticket.
- Keep card data out of call recordings, chat transcripts, and email inboxes.
- Replace stored card numbers with tokens from the processor.
- Run address verification with the CVV check. A CVV match alone does not confirm the cardholder.
- Confirm PCI DSS scope each year. Any system that touches card data is in scope.
What is unknown
The size of the market for stolen card data is estimated by security firms. The estimates use different methods. No public figure verifies a given listing as live, and none predicts the usable share of a batch.