What a CVV is
A CVV is a 3-digit code printed on the back of a Visa, Mastercard, or Discover card. American Express prints a 4-digit code on the front. Issuers also call it CVV2, CVC2, or CID. The code proves that the person typing a card number holds the card.
No compliant merchant can sell a CVV
PCI DSS Requirement 3.2 states that merchants and processors must not store sensitive authentication data after authorization. CVV and CVC values are sensitive authentication data. A bank, a processor, or an online store that keeps them is out of compliance and subject to fines. That leaves one source for a CVV listed on a market: a breach, a skimmer, or a phishing page. Security teams call the result card-not-present fraud, and it is the largest category of identity theft reports that reach the FTC.
The legal position in the United States
18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. Buying, selling, transferring, or possessing card numbers with intent to defraud falls inside that statute. A first offense carries a fine and up to 10 years in prison. Some subsections raise the maximum to 15 years. Attempt and conspiracy are separate charges. 18 U.S.C. § 1343 adds wire fraud, with a maximum of 20 years. Prosecutors charge buyers, not just sellers. A bitcoin payment creates a permanent ledger entry that investigators can tie to an exchange account, a wallet cluster, or an IP address.
Buy CVV With Bitcoin "No Scam": Every Offer Is Fraud
What happens after a bitcoin transfer
- Bitcoin settlements finish in minutes and cannot be reversed. There is no chargeback process.
- Storefronts that list card data shut down and reopen under a new domain. Lifetimes run from weeks to months.
- Some shops are phishing pages that capture wallet seed phrases, passwords, and IP addresses from the buyer.
- Seized domains stay online under law enforcement control and keep logging buyer traffic.
- Escrow and "vendor rating" systems have no legal enforcement. A dispute has no court, no chargeback, and no refund.
Documented takedowns
Operation against Genesis Market in April 2023 produced 119 arrests across 17 countries, per Europol. The BriansClub store lost 26 million card records to a breach in 2019. Joker's Stash closed in 2021. UniCC retired in 2022. Try2Check, a card-checking service, drew charges from the U.S. Department of Justice in 2023. Each case ended with seized infrastructure, seized crypto, or prison terms.
Parameters that actually protect a card
- AVS: the issuer compares the billing address to the address on file.
- 3-D Secure: the issuer sends a challenge to the cardholder's device at checkout.
- Tokenization: the merchant stores a token, not the 16-digit number.
- Velocity checks: the issuer blocks several charges in a short window.
- CVV check at authorization: the code is verified and then discarded.
Pitfalls to expect from any such purchase
- Dead card data. Balances get drained by earlier buyers of the same record.
- Malware on the buyer's machine that redirects wallet pastes to a different address.
- Exit scams where the shop takes deposits and closes the same week.
- Legal exposure that outlasts the shop, because blockchain records do not expire.
If your own card data leaked
Call the issuer, request a new card number, and check the last 12 months of statements. Set a fraud alert with one credit bureau, which notifies the other two. Report the theft at IdentityTheft.gov and keep the report number. A CVV that has been exposed cannot be reused once the card is reissued.