There is no legal way to buy CVV or CVC codes online with PayPal. A CVV is the verification value printed on a real payment card, and selling that code without the cardholder's permission is card fraud. PayPal bans these payments, so every listing, forum post, and private message that offers "CVVs with PayPal" is either a scam aimed at your money or a trap that can make you part of a crime.
That answer holds whether the listing says fresh CVVs, fullz, or test cards. The product does not exist on the open market. What exists is stolen card data and a long line of people willing to sell the same digits twice.
Top Pick for Buying CVV Online: A Comprehensive Buying Guide
What is a CVV, and why can't it be sold?
A CVV (also written CVV2, CVC2, or CID) is a code the card issuer generates to prove the physical card is in hand during a card-not-present purchase. It is not a standalone product. The only party with a claim to it is the bank that issued the card.
- CVV2 / CVC2 / CID: the printed code on the card face. A merchant may ask for it at checkout but must not store it once the transaction is approved.
- Card number and expiry date: identifiers, not proof of possession. The CVV is the part that shows the card is present.
- Authorization: the issuer's approval that ties the number, date, and code to one purchase.
Strip the cardholder's consent away and the code becomes stolen data. That is why card networks, banks, and the PCI DSS rules treat a CVV as sensitive authentication data rather than a product you can list, price, and ship.
Why "buy CVV with PayPal" offers are almost always scams
Sellers ask for PayPal because buyers trust the brand. It is also the fastest way to take money from someone and vanish.
- Friends & Family requests. That button turns a purchase into a gift. No case, no dispute path, no reversal.
- "No refunds, no chargebacks." A merchant who fears disputes is selling something that cannot survive a dispute.
- Gift cards, crypto, or "invoice then release." Your money leaves your control before you receive anything.
- Free sample CVVs. The sample is bait. The paid batch is either dead cards or nothing at all.
- Vouch screenshots and balance photos. Images cost nothing to fake, and chat history is easy to stage.
If a seller insists on PayPal Friends & Family, treat the deal as closed. You cannot open a case, and PayPal will side with the account holder when the activity traces back to stolen card data.
What happens if you send the money anyway?
- The payment is gone. Friends & Family transfers carry no purchase protection, and PayPal does not refund money sent for illegal goods.
- Your account gets limited or closed. Risk models flag new accounts that move funds to known carding wallets, and a permanent ban follows.
- Your bank sees the trail. Card issuers monitor merchants and counterparties tied to fraud, and your own account can be frozen during review.
- You inherit legal risk. US law treats trafficking in stolen card numbers and access devices as a federal crime, and intent to defraud is not required for the charge to apply.
Nothing about the transaction improves your position. You lose money in the best case and face an investigation in the worst.
How PayPal and the card networks catch CVV sales
Payment fraud defenses are built to spot exactly this pattern, and they work on data, not on trust.
- Velocity and counterparty checks. New accounts that send funds to flagged wallets get reviewed before the transfer clears.
- 3D Secure and issuer risk scoring. A card-not-present charge triggers step-up authentication when the issuer sees an unusual device, IP, or shipping address.
- Chargeback data sharing. Networks pool fraud reports, so a merchant that sells card data gets shut down across processors.
- Account limitation. PayPal's user agreement bars illegal transactions and permits holds, freezes, and closures while an account is reviewed.
None of these systems care that the buyer paid with a real PayPal balance. The pattern is the evidence.
What legitimate buyers actually need instead
If your goal is to accept card payments for a real business, you never buy CVVs. You rent the ability to process them, and you let a compliant provider hold the sensitive data.
- Tokenization. Store a token that stands in for the card number. The CVV is discarded after authorization.
- Hosted fields or a payment iframe. The card data passes straight to the processor, so your servers never touch it.
- PCI DSS scope reduction. Fewer systems that see card data means less to audit and less to lose.
- 3D Secure and AVS. Address Verification Service and step-up authentication cut fraud losses without blocking real customers.
That path costs money and paperwork. It also keeps your business legal, which is more than any CVV seller can offer.
How to protect your own CVV from theft
- Keep the code covered and never read it aloud in a store, on a call, or in a chat.
- Use virtual card numbers for unfamiliar online stores. The issuer generates a one-time or limited code that dies after use.
- Turn on transaction alerts so you see a charge the moment it posts.
- Type store addresses by hand. Lookalike domains harvest card numbers, expiry dates, and CVVs at checkout.
- Never email, text, or DM a CVV. No bank, processor, or PayPal agent asks for it that way.
If someone contacts you asking for a CVV to "verify" a refund or unlock an account, that is a scam in progress. Hang up, log in through the official app, and check the account yourself.
If you already paid a CVV seller
- Contact PayPal and report the transaction, even if it was sent as Friends & Family. Say what the payment was for.
- Call your bank or card issuer and dispute any charge that funded the payment.
- Change your PayPal password, revoke connected apps, and enable two-factor authentication.
- File a report with the FTC at ReportFraud.ftc.gov and a complaint with the FBI Internet Crime Complaint Center at ic3.gov.
- Watch your statements for 60 to 90 days. Scammers who get one payment often try again.
Common questions
Does PayPal allow CVV sales?
No. PayPal's user agreement and acceptable use policy bar illegal transactions, and card data sales fall in that group. Accounts tied to them get limited, frozen, or closed.
Can I get my money back after paying for CVVs?
In most cases, no. Friends & Family transfers have no purchase protection, and PayPal will not refund a payment made for illegal goods. A bank dispute can sometimes recover the funding source, which is the only realistic route.
Are there legitimate sites that sell card numbers?
No. Card numbers belong to the issuing bank and the cardholder. What legitimate businesses pay for is payment processing, tokenization, and fraud screening, not raw card data.
Why do sellers offer "test CVVs" for free?
Free samples build trust. The first code may even authorize, because a working card is the cheapest marketing tool a fraud seller has. The paid order that follows rarely works.
What is the safest way to pay online?
Use a virtual card number or a payment service that tokenizes your card, keep the CVV out of emails and chats, and check the store's domain before you type anything.