What "buy CVV shop online" refers to

A CVV is the 3-digit code on the back of a Visa, Mastercard, or Discover card, or the 4-digit code on the front of an American Express card. The code proves the person entering a card number holds the physical card. A CVV shop sells card numbers, expiration dates, and CVV codes taken from other people. The product is stolen account data, not a security tool.

Legal status in the United States

Buying or selling card data falls under 18 U.S.C. 1029, fraud and related activity in connection with access devices. A first offense carries up to 10 years in prison. Certain aggravated counts carry up to 15 years, plus fines. Possession of 15 or more unauthorized access devices is a separate charge. No federal or state agency licenses a CVV marketplace. There is no lawful version of this transaction to compare prices on.

Why the transaction fails for the buyer

  • No recourse. Payment runs through crypto or gift cards. Chargebacks do not exist for these purchases.
  • Dead cards. Issuers cancel compromised numbers within hours to days after a breach is detected.
  • Repeat demands. Buyers report requests for more payment to release an order that was never shipped.
  • Malware. Some storefronts bundle infostealers with the order or require a wallet-draining browser extension.
  • Logging. Some domains record IP addresses and wallet identifiers and pass them to researchers or police.

Red flags on sites that advertise card data

  1. Prices listed per card, often $1 to $20, with volume discounts. Real card data has no public price list.
  2. Uptime and "freshness" counters that no independent party verifies.
  3. Escrow claims with no named escrow operator.
  4. Contact through Telegram, Discord, or a single web form with no legal entity named.
  5. Reviews on the same domain that sells the product.

How card-not-present fraud works

Card-not-present fraud happens when a card number is used without the physical card. The spread of EMV chip terminals in stores moved fraud volume to online checkout, where the chip cannot be read. The FTC reports that credit card fraud is the largest category of identity theft in its Consumer Sentinel complaint data. Issuers absorb most of the loss on consumer credit cards. Merchants carry chargeback fees and lose the shipped goods.

If your CVV was exposed

  1. Call the number on the back of the card. Ask for a block and a reissue with a new number.
  2. Read statements for small test charges, often $1 or less, that precede larger ones.
  3. Place a free credit freeze with Equifax, Experian, and TransUnion.
  4. File a report at IdentityTheft.gov and a complaint with the FBI IC3.

Protecting your own CVV at checkout

Use merchants that store a network token in place of the card number. Use virtual card numbers from your issuer for subscriptions and unfamiliar sites. Keep the CVV out of notes apps, email, and chat threads. Confirm the checkout page sits on the merchant's own domain before entering the code. Card network rules prohibit storing the CVV after authorization, so any site that asks you to re-enter it on a stored card is outside the rules.