Before You Enter Your Card Details
The three or four digit code on your card exists to prove the physical card is in the buyer's hand during a card not present purchase. A store that asks for it at checkout is behaving normally. A person who asks you to send it by email, chat, or phone is not. Card industry rules forbid merchants from storing that code after a transaction is authorized, and no legitimate seller offers card numbers for sale. This guide covers how to judge a store before you trust it with your CVV, which details to compare, and which signals mean you close the tab.
Prerequisites
- A credit card rather than a debit card, so a dispute does not tie up cash in your checking account.
- The store's legal name and the billing descriptor it will print on your statement.
- A copy of the product page, the final price, and the shipping promise saved before you pay.
Steps
- Type the store address into the browser yourself instead of following a link from an ad, a text message, or a marketplace chat.
- Confirm the checkout page uses HTTPS and that the domain in the address bar matches the domain you were shopping on a moment ago.
- Compare the price against two other retailers before you add the item to the cart.
- Read the return window, the refund method, and the cancellation terms on the site itself, not in a chat window.
- Find the support phone number and call it once to confirm a person answers.
- Locate the name of the payment processor printed at the bottom of the checkout form.
- Generate a virtual card number with a spending limit if your bank offers one, and use it for the first order.
- Enter the card number, expiry date, and CVV only in the dedicated card fields, and only after the order total matches the price you agreed to.
- Decline any request to resend the CVV by email or confirm it over the phone.
- Save the confirmation email and order number, then review your statement within three days of the charge.
Parameters to Compare Between Stores
- Payment processor and PCI DSS scope: a merchant that passes card data to a compliant processor never handles your CVV itself. A site that claims to store card numbers for faster checkout is a problem.
- Authentication: stores that support 3D Secure send you to your own bank for a one time code. That step protects you and moves fraud liability off your account.
- Billing descriptor: a clear merchant name makes a dispute simple. A descriptor you cannot recognize makes it slow.
- Refund path: money returned to the original card is standard. Store credit only, or a request that you cancel a chargeback, is not.
- Card on file: tokenized storage with the CVV omitted is normal. Storage that keeps the CVV breaks card industry rules.
- Contact depth: a street address, a working phone line, and a support address on the store's own domain.
Pitfalls to Walk Away From
- Requests for your CVV through email, text, social media, or a marketplace message system.
- Prices far below every other seller, paired with a countdown timer and limited stock claims.
- Payment by gift card, wire transfer, cryptocurrency, or a person to person app for a shipped product.
- Checkout pages with no padlock, a padlock on a different domain, or a form that asks for your PIN.
- Sellers who offer card numbers, card data, or CVV files for sale. Buying or selling that data is a crime in the United States and most other countries, and the files are usually stolen, expired, or fabricated.
- Pressure to finish the purchase off the store's own site.
After the Charge Posts
- Match the charge to your order confirmation and the billing descriptor.
- Report an unauthorized charge to your card issuer the same day you find it.
- Keep the dispute reference number until the case closes.