The top pick for anyone searching to buy a CVV is not a shop at all: it is a virtual card number issued by your own bank or card issuer. That is the only place you can obtain a working card number, expiry, and CVV that you are legally entitled to use, and it costs nothing beyond your existing account. The criteria below are the ones that actually separate a usable card-number source from a dead end: who is legally allowed to issue the number, whether the CVV is bound to your identity, whether you can revoke it after one purchase, and whether the seller carries any liability if the number fails at checkout.
Virtual card numbers from your issuer
Most major US card issuers and several fintech accounts now generate single-use or merchant-locked card numbers on demand. The number, expiry, and CVV are real, they pass the same authorization checks as your physical card, and they stop working after the limit or the first charge.
- Pros: Free with an eligible account; CVV is issued to you, not scraped from someone else; you set the spend cap; a leaked number cannot be reused; chargeback rights stay with you; no counterparty to trust.
- Cons: Availability varies by issuer and account type; some subscriptions reject single-use numbers; merchant-locked numbers need a fresh generation per store; support quality depends on your bank.
Use it for: one-off purchases at unfamiliar merchants, free trials you may forget to cancel, and any checkout where you would rather not hand over your primary card.
Digital wallets and tokenized checkout
Apple Pay, Google Pay, and merchant-saved tokens replace the card number with a device-specific token, so the CVV you would otherwise type is never transmitted to the merchant.
- Pros: No CVV entry at all on supported sites; token is useless if a merchant database leaks; strong device-level authentication; fast repeat checkout.
- Cons: Not accepted everywhere; tied to a device you must keep secured; subscription management can be awkward across platforms; troubleshooting failed payments is harder because you cannot inspect the number.
Use it for: everyday repeat merchants and mobile checkout, where speed and leak resistance matter more than control over the exact number.
Prepaid and reloadable cards
A prepaid card gives you a genuine CVV that you own, with a hard ceiling on exposure.
- Pros: Spend limited to the loaded balance; useful for boundaries on subscriptions; widely accepted where virtual numbers are rejected.
- Cons: Activation and identity verification required in the US; fees vary; weaker dispute process than a credit card; some merchants block prepaid BINs.
Use it for: budgeting a specific purchase, or a teen or secondary cardholder where you want a hard limit.
"CVV shops" that market themselves as legit
No legitimate merchant, processor, or bank sells card numbers with their CVVs attached. A site offering bundles of card number, expiry, name, and CVV is selling payment credentials taken from someone else, which is card-not-present fraud regardless of how the storefront describes itself. There is nothing to compare on price or delivery, because the supply is stolen data and the operator has no legal standing to sell it.
- Pros: None that survive scrutiny. Delivery speed and "replacement guarantees" are marketing claims, not enforceable terms.
- Cons: You are committing a federal offense; the numbers are frequently already dead or flagged; payment is usually irreversible crypto; operators routinely resell the same data; there is no recourse and no support channel; account and device details you share become part of someone else's fraud kit.
Bottom line: treat every such site as a scam and a legal hazard, not a vendor.
Parameters to check before you type a card number anywhere
- Who issues the number. If it is not your bank, your issuer, or a regulated prepaid program, stop.
- Revocability. Can you freeze or burn the number after one use? If not, the exposure is open-ended.
- Spend cap. A number with a limit you set is a number with a known worst case.
- Dispute rights. Credit cards carry the strongest chargeback position; debit and crypto do not.
- Transport security. Check for a valid certificate and a recognizable payment processor at checkout, not just a padlock on the landing page.
- Data retention. PCI rules forbid merchants from storing the CVV after authorization, so any site that asks you to re-enter or "confirm" a stored CVV is a red flag.
Pitfalls that catch people
- Confusing "the checkout accepted it" with "the purchase is safe." Authorization is not settlement, and stolen numbers often authorize once before failing.
- Paying by crypto, gift card, or wire for anything card-related. These rails exist to make reversal impossible.
- Trusting escrow badges, review screenshots, or Telegram vouches on a storefront that sells payment credentials.
- Assuming a small first purchase proves a seller is real. That is the standard setup for a larger loss.
- Typing card details into a site reached from an ad or a DM rather than by navigating to the merchant yourself.