There is no legal or safe way to buy CVV data online in 2024, on the dark web or anywhere else. A CVV is the three or four digit code tied to a payment card, and it belongs to the cardholder. Buying, selling, or using someone else's code is payment card fraud, and in the United States it falls under federal wire fraud and access device statutes with prison time attached.
This page explains what that market really is, why buyers lose money, and how to keep your own CVV out of it.
What people mean when they search for CVV data
A CVV (card verification value) is a short code printed on a card. Visa calls it CVV2, Mastercard calls it CVC2, and American Express prints a four digit CID on the front.
Merchants ask for it during card-not-present transactions to prove the buyer holds the physical card. That is the whole purpose. The code is not a password, not a license, and not a product.
Searches for a "CVV shop" or a "fullz" listing describe stolen payment records bundled with names, addresses, and sometimes Social Security numbers. Those bundles come from breaches, skimmers, and phishing. Nothing about buying them is legitimate.
Why the dark web CVV market is a trap for buyers
- Fake listings: sellers run "shops" with bots that generate card numbers. The checkers fail, and the buyer has no recourse because the transaction is criminal.
- Exit scams: a shop builds reviews, takes deposits in crypto, then closes. Buyers cannot complain to anyone.
- Recycled data: the same card number gets sold to many buyers. The first charge triggers a fraud alert and the rest die.
- Honeypots: some "shops" are run by criminal groups collecting buyer identities, IP addresses, and wallet data for later extortion.
- Malware bait: "checker" and "validator" tools often ship with infostealers that drain the buyer's own crypto wallet.
The net result for most buyers is a total loss plus a permanent record. Crypto payments leave a trail that law enforcement can follow once an exchange complies with a subpoena.
The legal exposure in plain terms
In the US, 18 U.S.C. § 1029 covers fraud and related activity with access devices. Selling, transferring, or using a stolen card number is a federal crime with penalties that include fines and prison terms measured in years.
State laws add their own charges, often aggravated identity theft when a Social Security number travels with the card data. The UK, Canada, Australia, and the EU have matching statutes.
Buying is not a lesser offense. Possession with intent to use is enough in most jurisdictions. A buyer who never completes a purchase still faces charges for the attempt.
How to protect your own CVV
Card issuers and networks spend a lot on this problem, which is why your job is smaller but still matters.
Online shopping habits
- Save cards only with merchants you trust and that support tokenization. A stored token replaces the real number.
- Use virtual card numbers from your issuer for subscriptions and one-off sites. You set the limit and can kill the number after use.
- Skip the "save my card for next time" box on unfamiliar checkout pages.
- Never type card details into a page that loaded from an email link or a social ad.
Account and device hygiene
- Turn on two-factor authentication for every shopping account and email inbox. Email is the reset path for everything else.
- Keep a password manager. Reused passwords turn one breach into ten.
- Update your phone and browser. Skimmers and infostealers rely on old builds.
- Check statements weekly. Small test charges, often under a dollar, come before the big ones.
If your card data shows up in a breach
- Freeze the card in your banking app or call the issuer. A freeze stops new charges right away.
- Request a new card number. A replacement plastic with the same number does not help.
- Change the password on any account that stored that card, then change it anywhere you reused that password.
- Pull your free credit reports at AnnualCreditReport.com and look for accounts you did not open.
- File a report at IdentityTheft.gov if the data included your SSN, and keep the report number.
US cardholders have zero liability for unauthorized charges under federal law, provided they report the problem in a reasonable time. Speed matters more than anything else.
FAQ
Can you buy CVV data legally anywhere?
No. There is no jurisdiction where a card verification value is a tradable asset. Legitimate card data moves between banks and processors under contracts and network rules, never as a retail product.
Is selling CVV data a felony in the US?
Yes. 18 U.S.C. § 1029 makes it a federal felony, and sentences often run alongside identity theft charges. A first offense can still mean years in prison.
Do CVV checks stop card-not-present fraud?
They raise the cost of fraud. They do not stop it. Stolen codes travel with stolen card numbers, which is why merchants also use address verification, 3-D Secure, and risk scoring.
Why do scammers keep selling CVV data if it rarely works?
The business model targets buyers, not cardholders. Selling a fake list to a hundred people pays better than using one real card.
Bottom line
Searching for a place to buy CVV data puts you in the crosshairs of criminals and prosecutors at the same time. The only winning move is to defend your own cards and report fraud the moment it appears.