What a CVV dump is
A CVV dump is a copy of data stored on a payment card. The record holds the primary account number, the expiration date, a cardholder name, and the three-digit card verification value. Some records add magnetic stripe track data. The data comes from skimmers, point-of-sale malware, phishing pages, or breached merchant databases. It does not come from the cardholder.
How to Buy CVV Dumps Safely for Online Purchases
Buying a dump is a federal crime
U.S. law treats a payment card number as an access device. Under 18 U.S.C. 1029, it is a crime to traffic in, possess, or use access devices with intent to defraud. Trafficking carries up to 15 years in prison and fines. Possession with intent carries up to 10 years. The statute reaches the buyer, the seller, and the broker.
Prosecutors do not need a completed purchase. An agreement to buy, or possession of the file, is enough. Undercover agents run storefronts and forums. Files sold as new stock often come from those operations.
What buyers receive
- Cards the issuer already canceled
- Records that do not match the stated bank, country, or card brand
- No file at all after payment
- A payment trail that becomes evidence
No marketplace guarantees a card will work. No refund policy exists. The seller keeps the payment. The buyer carries the risk.
Why the value of a dumped number falls
Card networks added checks that strip value from a stolen number. Tokenization replaces the account number with a token that works at one merchant. 3-D Secure adds an issuer authentication step at checkout. EMV chips make cloned stripe data fail at chip terminals. Card verification value requirements block orders that lack the printed code.
What cardholders can do
- Read statements each month and dispute charges that are not yours.
- Report unauthorized charges to the issuer. The Fair Credit Billing Act caps credit card liability at 50 dollars.
- Freeze credit files at Equifax, Experian, and TransUnion.
- Use a virtual card number for online merchants.
- Enable transaction alerts on the card app.
What merchants can do
- Require the card verification value at checkout.
- Do not store the code. PCI DSS bans keeping sensitive authentication data after authorization.
- Tokenize the account number in your systems.
- Run address verification and 3-D Secure on high-risk orders.
- Watch order velocity and billing and shipping mismatches.
Public figures for the size of the carding market vary and are not reliable. Court records list seizures and convictions, not total volume.