What a "CVV shop" actually sells
A site that advertises CVV data sells card numbers, expiry dates, and security codes in a bundle. Sellers call the bundle a "fullz" or a "CVV." The data comes from breaches, skimming devices, and phishing pages. None of it belongs to the seller. None of it is licensed for resale.
Carding CVV Buy Cheap: Why the Search Fails and How to Protect Your CVV
In the US, buying or using that data falls under 18 U.S.C. § 1029, which covers access devices. Trafficking in one card can bring up to 15 years. A first offense with a few cards brings fines, restitution, and a felony record. Card networks and issuers also pursue civil claims.
The purchase fails more often than it works
- Recycled numbers. The same card is sold to several buyers. The first charge triggers a block.
- Dead cards. Issuers cancel cards within hours of a breach alert. A shop listing can be days old.
- Ripper exits. Shops close after payment and reopen under a new name. Buyers have no refund path.
- Malware in the deal. "Checker" tools and balance-check pages ship with infostealers that harvest the buyer's own files.
- Escrow theater. Forum escrow accounts are run by the same people who run the shop.
How the CVV code works
The CVV is a 3-digit code on Visa and Mastercard cards and a 4-digit code on American Express. Issuers generate it from the card number, expiry date, and a secret key. It is not stored on the magnetic stripe. It proves the person typing holds the physical card.
PCI DSS Requirement 3.2 forbids merchants from storing the CVV after authorization. A site that asks you to re-enter a code for a saved card is not compliant. A site that asks for the code by email is a phishing page.
Buying CVV Data Online: Why Carding Sites Are Scams and Crimes
What to use instead
- Virtual card numbers from your issuer, set for one merchant and one limit.
- Network tokenization through Apple Pay or Google Pay, which replaces the card number with a device token.
- Transaction alerts on every charge, sent by push or text.
- A card freeze in the issuer app when the card is not in use.
If your card data is exposed
- Freeze the card in the issuer app.
- Request a new number and a new CVV.
- File a report at IdentityTheft.gov and keep the report number.
- Check statements for 12 months. Test charges of $1 to $5 come first.
No legitimate vendor sells CVV data. The only legal CVV transaction is a cardholder typing their own code at checkout.