Advice first: no legal market sells CVV codes
The CVV2 or CVC2 is the 3 or 4 digit code printed on a payment card. It proves the person at the checkout holds the physical card. PCI DSS Requirement 3.2 forbids merchants and processors from storing that code after authorization. A shop that sells codes is selling data no legitimate business is allowed to keep. The data comes from a breach, a skimmer, or a phishing page, and the cardholder is the victim. In the US, trafficking in card data is a federal crime under 18 U.S.C. 1029, with prison terms that reach 10 years.
How the cheap shops operate
Listings price codes by card country, card brand, and issuing bank. Bulk lots cost less per card. Payment runs through crypto or gift card balance, so no chargeback path exists. Delivery is a file, a link, or nothing. Recorded outcomes include dead codes, codes already used, and buyer contact data resold after the sale. The FBI Internet Crime Complaint Center logs these losses as card fraud and identity theft. Card networks close the merchant accounts behind the charges, so the shops rotate domains.
Parameters to check before you send money
- Legal basis. Is the seller an issuer, an acquirer, or a merchant? None of the three sells codes.
- Storage claim. A party that holds a CVV after authorization sits outside PCI DSS scope. That is a red flag, not a feature.
- Price. A code priced below the card balance has no business model except fraud.
- Payment channel. Crypto and gift cards remove any refund route.
- Data source. No seller names a lawful source, because none exists.
Pitfalls
Buyer lists are a product. Some shops keep names, wallets, and chat handles, then sell them to extortion crews. Card testing is another trap: a buyer who runs a small charge to check a code creates a fraud record tied to their own payment method and IP address. Losses on the buyer side do not stop at the purchase price. Banks close accounts tied to card-testing traffic, and processors keep the data.
Legitimate routes for card-not-present payment
Issuers sell virtual card numbers to their own account holders. Those numbers link to a funded account and are not resold data. Networks offer tokenization, where a token replaces the card number and the merchant never stores the code. 3-D Secure moves authentication to the issuer. Merchants that need to cut fraud use address verification, a CVV check at authorization, and velocity limits on repeat attempts.