What a CVV is
Card networks print a verification code on every card. Visa, Mastercard, and Discover use three digits on the back. American Express uses four digits on the front. The code proves the physical card is in hand at checkout. PCI rules forbid merchants from storing it after authorization.
What sellers advertise
Listings for "CVV with bitcoin" sell a string of data: card number, expiration date, security code, cardholder name, and billing address. Payment goes through bitcoin. The seller keeps no name and no reversible record. That data comes from breaches, skimming devices, and phishing pages.
Legal status in the United States
Buying or selling card data without the cardholder's permission is a federal crime. 18 U.S.C. 1029 covers trafficking in unauthorized access devices. Penalties reach 15 years in prison. Fines reach $250,000 for an individual and $500,000 for an organization. 18 U.S.C. 1028A adds a mandatory two-year term for aggravated identity theft in many cases. The buyer carries liability, not only the seller.
Why the transactions fail
- No delivery. Bitcoin transfers are final. There is no chargeback and no refund path.
- Test batches. A small first order ships live data. The second order takes the money and ships nothing.
- Dead cards. Numbers pulled from old breaches are blocked by the issuer before resale.
- Recycled data. One card number is sold to 10 or more buyers in the same week.
- Fake escrow. The "escrow" service runs on the same infrastructure as the shop.
- Shipped malware. Some buyers get a link instead of data.
Network defenses
Issuers run address verification, CVV checks, velocity limits, and device fingerprinting on each transaction. 3-D Secure adds an authentication step at the bank. EMV chips and tokenization keep the real number out of merchant systems. A resold number fails those checks at a high rate. Decline rates above 90 percent are normal for resold data.
Card safety steps that work
- Use a virtual card number from the issuer for online purchases. Set a spending cap and a short expiration.
- Turn on transaction alerts by text or push for every charge.
- Freeze the card in the issuer app when it is not in use.
- Keep card data out of merchant accounts. Re-enter it per purchase where the site allows.
- Check card readers at gas pumps and ATMs for loose housings, tape, or added hardware.
- Use 3-D Secure when the merchant offers it.
If a number was used without permission
Call the issuer and close the card. Federal law caps credit card liability at $50, and at $0 when the number is used without the physical card. Dispute the charges in writing. Report the event at IdentityTheft.gov and to the FBI Internet Crime Complaint Center. File a police report if the issuer asks for one.
Bottom line
No service makes an unauthorized card purchase safe or legitimate. Bitcoin sent to a seller is unrecoverable. The data is often dead on arrival. The act carries federal criminal liability. Cardholders who want fewer fraud losses get more from virtual numbers, alerts, and freezes than from any listing.