What the keyword means
CVV and CVC are the 3 or 4 digit verification codes printed on a payment card. The code proves the physical card is in hand during a card-not-present transaction. A CVV listing on a dark web forum is not software, not a service, and not a discount card. It is a record of a card account, taken from a breach, a skimmer, or a phishing page. The seller does not own the account and cannot authorize its use.
Buying CVV With Bitcoin on the Dark Web: Why Buyers Lose
Legal status in the United States
18 U.S.C. 1029 covers access device fraud. A card number, expiration date, and CVV together form an access device. Trafficking in access devices, which includes selling, transferring, and possessing them with intent to defraud, is a federal felony.
Buying Guide: Safe and Cheap CVV/CVC for Online Purchases
- Statutory maximums reach 10 years for a first offense under several subsections, and 15 years under others.
- Each card record can support a separate count.
- Buyers are charged as principals. The purchase is the offense.
The FBI and the Department of Justice have seized multiple carding marketplaces, including AlphaBay and Hansa. Later takedowns named buyers and sellers.
Why buyers lose the money
There is no court, no chargeback, and no regulator in this market. Sellers quote a valid rate and give no way to confirm it before payment.
- Exit scams: the shop closes after a run of deposits.
- Recycled records: the same card data sold to many buyers, so the first use triggers a block.
- Fake checkers: the tool that validates a card is operated by the seller.
- Escrow held by the forum owner, who has an interest in the outcome.
- Drop addresses already flagged by carriers and by card networks.
Parameters sellers advertise, and what they mean
Listings quote BIN, country, card brand, base, and freshness. None of these are auditable by the buyer. BIN data is public, so a BIN list is not evidence that an account exists. Fresh is a claim with no timestamp the buyer can check. Valid rate is a percentage the seller sets. Bulk pricing per record is low because the same file goes to many buyers.
Card-not-present fraud
EMV chip terminals at US merchants pushed fraud into online channels. A merchant who requests the CVV at checkout and validates it can shift liability for a fraudulent charge to the issuer. A merchant who skips CVV verification absorbs the loss.
If your own card appears in one of these listings
- Call the issuer. Ask for a block and a reissue with a new number.
- Review statements for small test charges.
- Report to the FTC and to the FBI Internet Crime Complaint Center.
- Under the Truth in Lending Act, liability for unauthorized credit card charges is capped at $50.
Data on total losses from card-not-present fraud in a given year is reported by the card networks and by the FTC; figures vary by methodology.