What the Search Term Means
A CVV is the 3-digit code on the back of a Visa or Mastercard. American Express prints a 4-digit CVC on the front. The code proves the buyer holds the physical card.
The phrase "buy CVV with bitcoin" names a market for stolen card records. Sellers list card number, expiry date, cardholder name, and CVC. Payment moves through bitcoin or another cryptoasset. No legal US market sells card data this way. Card issuers do not sell CVVs. Cardholders do not sell CVVs.
US Law
- 18 U.S.C. § 1029 covers trafficking in and use of unauthorized access devices. A payment card number counts as an access device.
- Penalties reach 10 years in prison for offenses involving $1,000 or more in a one-year period. Fines follow 18 U.S.C. § 3571.
- 18 U.S.C. § 1343 covers wire fraud for the online deal itself.
- 18 U.S.C. § 1956 covers money laundering when crypto proceeds move through an exchange.
Prosecutors stack counts. One purchase can support charges under more than one statute. Federal sentencing guidelines add levels for the number of victims and the loss amount.
CVV/CVC Security for Online Purchases: How to Protect Your Card at Checkout
Why the Listings Fail on Their Own Terms
Data sold in these channels is often dead. Issuers cancel compromised numbers within days. Test charges trip fraud rules at the bank.
Sellers resell the same card to many buyers. Escrow holds in these markets are run by the same people who sell the data. There is no arbitration, no refund, and no contract a buyer can enforce in court.
Buyers also lose the bitcoin. Blockchain analysis firms trace exchange deposits. Know-your-customer records at an exchange link a wallet to a name and a bank account.
What Reduces CVV Risk
The CVC defends card-not-present transactions. Merchants and issuers pair it with other signals.
- Tokenization replaces the card number with a token for repeat payments. The CVC is not stored.
- 3-D Secure adds an issuer check at checkout.
- Address Verification Service compares billing data.
- Velocity limits block rapid repeat attempts on one number.
- PCI DSS forbids storing the CVC after authorization.
For cardholders: do not read the CVC over the phone to an inbound caller. Do not enter it on a page reached from an unsolicited text. Use a virtual card number for one-off purchases when the issuer offers one.
If You Find Card Data for Sale
Report it to the card issuer and to the FBI Internet Crime Complaint Center. Issuers reissue cards and reverse fraudulent charges. Consumer liability caps at $50 for credit cards under 15 U.S.C. § 1643, and at $50 for debit cards reported within two business days.
Public counts of the stolen-card market are estimates. No registry tracks active listings.