Start with what a CVV is
A CVV is a 3 or 4 digit number printed on a payment card. Visa, Mastercard and Discover put 3 digits on the back. American Express puts 4 digits on the front. The number checks that the person holding the card has the card in hand. It is not a password, and it does not transfer with a purchase of data.
2024 Dark Web CVV Market: A Shopper's Security Guide
Card networks require the CVV on card-not-present transactions for one reason: to prove physical possession. A list of numbers does not prove possession. That gap is where fraud detection sits.
What a "CVV dump" listing actually sells
Sellers use "dumps" for card data copied from a magnetic stripe or pulled from a breach. A listing that pairs a card number with a CVV claims the data belongs to a live account. The seller does not own that account. The cardholder did not agree to the sale.
Where to Buy CVV on the Dark Web in 2024: A Complete Buying Guide
In the US, buying or selling this data is a federal crime under 18 U.S.C. § 1029. Trafficking in access devices carries up to 15 years per count. Wire fraud under 18 U.S.C. § 1343 adds up to 20 years. Prosecutors charge buyers, not only sellers. The FBI and Dutch police shut Genesis Market in April 2023 and made arrests across multiple countries, including users.
Buy CVV: A Comprehensive Buying Guide for CVV on the Dark Web
Parameters sellers quote
- Price per record. Listings quote $1 to $60 by card type, issuer country and claimed balance. No figure is auditable before payment.
- Base and country fields. These name the issuing bank and its country. They say nothing about whether the card is open.
- Validity rate. A quoted 90 percent rate is a seller claim. Issuers cancel a card after the first failed authorization, so a second use on the same record is rare.
- Escrow and replacement. Most markets hold funds in escrow run by the same operators who control the account. A market can close with balances inside.
- Authentication stage. Most US issuers now push 3-D Secure on card-not-present traffic. A dump with a CVV does not clear a challenge sent to the cardholder's phone.
Pitfalls
Legal exposure is the first. Payment trails, chat logs and wallet records survive market takedowns, and cases are built from seized servers.
Loss of funds is the second. A buyer has no contract, no chargeback and no court to appeal to. Exit scams and fabricated records are common. Carding sites also serve malware, including infostealers that take over the buyer's own accounts.
The third is scale. The FTC ranks card fraud among the top reported identity theft categories, and issuers absorb losses by reissuing cards. The victim is a person whose account is drained and whose number is replaced.
Protecting your own CVV
PCI DSS forbids storing the CVV after authorization, so no merchant should ask you to save it. Use a virtual card number for online checkouts and set a per-transaction limit. Keep the CVV off paper and out of notes apps. Check card readers and gas pumps for overlays before you swipe. Read statements on a schedule you set, not when a charge looks wrong.