If you want to buy card numbers for online purchases, the top pick is a virtual card number issued by your own bank or card issuer and paired with a tokenized wallet at checkout. It carries the issuer zero liability policy, it can be capped per merchant, and it can be killed the moment something looks wrong. This guide compares that option against prepaid cards and network tokenization using five criteria: legal standing, issuer backing, spend controls, merchant acceptance, and what recovery looks like when a charge goes bad. It also covers why listings that promise CVV data for carding fail every one of those criteria.
Why CVV carding listings are a losing purchase
Carding runs on stolen account data, and buying that data is a federal crime in the United States under access device fraud statutes, with wire fraud and identity theft charges stacked on top. The practical problems are just as bad as the legal ones. Sellers in these markets resell the same numbers to multiple buyers, dump stale records from old breaches, and bundle malware with the order. Some storefronts are run by law enforcement. When a purchase fails there is no chargeback, no support desk, and no way to complain without exposing yourself.
- No dispute rights: stolen data comes with no refund path.
- Reused inventory: the same card data is sold to many buyers.
- Malware risk: download links and checker tools are common infection vectors.
- Legal exposure: using a stolen number is the crime, not just buying it.
Option 1: Virtual card numbers from your issuer
Most large US banks and several fintech apps let you generate a virtual number in the app or browser extension. The number is tied to your real account, so the zero liability policy still applies, but the PAN you hand to a merchant is disposable.
Pros
- Legally clean and backed by the issuer fraud team.
- Lock the number to one merchant or set a dollar ceiling.
- Freeze or delete a number without touching your main card.
- Recurring billing keeps working on the dedicated number.
Cons
- Some merchants reject virtual BIN ranges, especially travel and rental holds.
- Not usable where a physical card must be presented.
- Rewards and card benefits sometimes differ from the primary card.
Best for subscriptions, free trials, and one-off buys at merchants you have not shopped with before.
Option 2: Prepaid and reloadable cards
A prepaid card holds a fixed balance and is not connected to your checking account. That ceiling is the whole point: if the number leaks, the loss stops at the remaining balance.
Pros
- No link to your bank account or credit line.
- Physical version works at merchants that block virtual numbers.
- Hard spending cap by design.
Cons
- Almost all reloadable cards require identity verification at signup.
- Fees for purchase, reload, and inactivity vary by product.
- Dispute rights are weaker than credit card protections.
- Holds for hotels, fuel, and rentals can tie up the balance.
Best for budget control and for shoppers who want to keep a bank card out of an unfamiliar checkout page.
Option 3: Network tokenization at checkout
Mobile wallets and browser autofill replace your card number with a network token plus a per-transaction cryptogram. The merchant never receives the real account number, and a stolen token is useless outside its assigned device or merchant.
Pros
- Real account number never reaches the merchant.
- Token is bound to a device or merchant, so leaks have limited value.
- Works in apps and most modern browsers.
- No extra fee to the cardholder.
Cons
- Requires a compatible device or browser.
- Useless for phone orders and mail order merchants.
- You cannot hand the payment credential to another person.
Best for routine mobile and desktop checkout where you want the least exposure with the least effort.
Parameters to compare before you buy
- Liability holder: who eats the loss if the charge is fraudulent.
- Spend controls: per-transaction limits, monthly caps, merchant locks.
- Freeze and rotate: how fast you can kill a number and issue a new one.
- Acceptance: whether the merchant category you shop blocks that BIN range.
- Fees: issuance, reload, foreign transaction, and inactivity charges.
- Dispute process: written timelines and provisional credit rules.
- Data retention: what the provider stores and for how long.
Pitfalls to avoid
- Buying CVV data from forums, chat apps, or dark web shops.
- Using a debit card tied to your main checking account at unknown merchants.
- Saving card numbers in a notes app or browser without a passcode.
- Skipping 3-D Secure prompts because they add a step.
- Assuming a virtual card hides your identity. Billing name and address still pass to the merchant.
- Paying with gift cards, which carry no dispute rights at all.
Bottom line
An issuer virtual card plus tokenized checkout gives you the controls that carding markets pretend to offer, with fraud protection and no criminal exposure. Prepaid cards cover the cases where you need a physical card and a hard spending ceiling. If a seller promises working CVV data for carding, the only realistic outcomes are a drained account, a malware infection, or a criminal charge.