Buying from a CVV shop means paying for stolen card data, and in the US that is a federal crime under 18 U.S.C. § 1029, with a first offense that can carry up to 15 years in prison. The listings belong to real cardholders, the sellers take crypto and offer no refunds, and the shops are run by people with every reason to cheat a buyer. There is no safe or legal way to buy from a CVV shop in 2024.
What is a CVV shop?
A CVV shop is a storefront that sells stolen payment card records. Each listing bundles a card number, expiry date, the 3 or 4 digit verification code, and often the cardholder name and billing address.
Buy From a CVV Shop With Bitcoin? Read This First
Sellers price listings by card brand, issuing country, and card tier, and they push a "valid rate" percentage as proof of quality. That number comes from the seller. Nobody can check it before money changes hands, and nobody audits it after.
Is buying from a CVV shop legal in 2024?
No. US law treats an unauthorized card number as an "access device," and 18 U.S.C. § 1029 covers buying, selling, and possessing one with intent to use it. A first conviction carries up to 15 years and fines that reach $250,000 for an individual.
Other countries take the same view. The UK Fraud Act 2006 covers possession of articles for use in fraud. Most EU states criminalize possession of stolen card data. No jurisdiction licenses a commercial market in CVVs.
Possession carries as much weight as use. Prosecutors do not need a completed purchase on the card. A stored list on your device plus intent is enough for a charge.
How do CVV shops work in practice?
- Registration is open or invite-only, often with a small deposit to start.
- Payment runs on crypto, so there is no chargeback and no dispute process.
- Some shops sell a "checker" that pings the issuer to test a card, and charge extra for it.
- Your balance sits inside the shop's ledger, not in your own wallet.
Each of those features removes a protection a normal buyer expects. Crypto kills the refund. The internal ledger kills the exit door. Open registration kills the vetting.
Why most CVV shop purchases fail
The failure rate is the part sellers never advertise. A card can pass a test at 10am and be dead at noon, because the cardholder reports the charge the moment it shows up in an app.
- Issuers cancel a compromised card within hours to days of a fraud report.
- Fraud engines score billing address, device, IP, and shipping mismatch, so a correct CVV alone still fails a checkout.
- The same listing gets resold to several buyers, so a card can be spent before you test it.
- Checker output and balance screenshots are easy to fake.
- Shops vanish with deposited balances, and no regulator will hear the complaint.
The "2024" in a shop name is a marketing device. It signals that the store is new, not that the data is fresh.
What risk does a buyer carry?
Beyond the criminal exposure, buyers hand their own identity to strangers. Shops log IP addresses, device fingerprints, and wallet IDs, and that log becomes evidence or a blackmail list once a server is seized.
Law enforcement seizures of carding servers in past cases produced records used against buyers, not just operators. Banks also close accounts tied to card fraud, and a closed account stays on file for years.
What is the legal version of what buyers want?
Most people who search for a CVV shop want a card number that is not tied to their main account. Banks and fintechs already sell that as a product. It is called a virtual card.
- Virtual cards: a separate number, expiry, and CVV from your own issuer that you can freeze or delete after one purchase.
- Tokenized payments: Apple Pay, Google Pay, and merchant vaults pass a token to the seller, so your card number and CVV never touch the shop's server.
- Prepaid cards: a fixed balance that caps the damage if a merchant leaks data.
- 3-D Secure: an extra verification step on card-not-present transactions, now standard in the EU and common in the US.
All four are legal, priced in normal currency, and come with a dispute process. That is the difference that matters.
How do you protect your own CVV online?
The CVV exists to prove the physical card is in hand. Any request to type it into an email, a chat window, or a phone call is a red flag, because a real merchant needs it only inside a payment form.
- Confirm the checkout page runs on HTTPS and sits on the merchant's own domain, not a redirect.
- Never store the CVV in a browser note, a spreadsheet, or a screenshot.
- Turn on transaction alerts for every card you use online.
- Use a virtual number for trial subscriptions and unfamiliar shops.
- Check the statement within 60 days, the window for disputing charges under the Fair Credit Billing Act.
Frequently asked questions
Can you get a refund from a CVV shop?
No. Payment is crypto and the balance sits with the shop, so there is no chargeback, no escrow, and no consumer protection. A shop that takes a deposit and closes has committed a second crime on top of the first.
Are CVV shops legal anywhere?
No. Every country that criminalizes card fraud also criminalizes the trade in card data. "Offshore" describes where a server sits, not where the buyer gets prosecuted. Buyers face charges in their own country.
What does CVV mean?
CVV stands for Card Verification Value, the 3 digit code on the back of most cards or the 4 digit code on the front of American Express cards. Networks also call it CVV2, CVC2, or CID.
Is it safe to enter my CVV on a website?
Yes, on a checkout built to PCI DSS. The standard forbids merchants from storing the CVV after authorization, so a site that asks you to resend an old code by email is out of compliance.
What happens if you use a card that is not yours?
That is card fraud plus identity theft in most US states, and it moves a case from possession to use, which carries heavier sentencing. Store cameras, IP logs, and delivery records make the case simple to build.
Short version: a CVV shop sells a stolen credential with no refund and a criminal record attached. If the goal is keeping your real card number off a merchant's server, ask your bank for a virtual card instead.