Start here: a CVV is not a product
The three or four digit code printed on a payment card is a verification value. It exists to prove that the person typing the card number is holding the physical card. It is not licensed, sold, or distributed as a standalone item. Every listing that offers "CVV" or "CVV fullz" for sale is offering either stolen account data or nothing at all. Buying either one is a crime in the US under identity theft and access device statutes, and the buyer has no recourse when the seller disappears with the payment.
Why the offers you find are traps
- Stolen card data. Sellers on forums and messaging apps traffic in card numbers taken from breaches, skimmers, and phishing pages. Holding or using that data is access device fraud.
- Advance-fee scams. Many "CVV shops" take payment in crypto and deliver a text file of numbers that were never valid.
- Honeypots. Some storefronts exist to collect buyer identities and payment details for the operator.
- Dead data. Issuers cancel compromised cards within hours of a fraud report, so purchased numbers fail at checkout.
What to do instead
If your goal is to pay for something online and you do not have a usable card, these routes work and carry no legal risk.
- Apply for a prepaid or secured card at a bank or credit union. Bring photo ID and a deposit.
- Buy a general-purpose reloadable prepaid card at a pharmacy or grocery store and register it to your name.
- Request a virtual card number from your existing issuer's app. Most large US issuers generate single-use or merchant-locked numbers on demand.
- Ask the merchant for alternative payment methods: bank transfer, invoice, or a gift card the merchant itself issues.
- Use a payment service that holds funds in an account and issues its own card, rather than a card number bought secondhand.
Parameters that matter in card-not-present checkout
- CVV length and location. Visa, Mastercard, and Discover print three digits on the back signature panel. American Express prints four digits on the front, above the card number.
- AVS. Address Verification System compares the billing street number and ZIP to the issuer's record. A mismatch can decline a transaction with a correct CVV.
- 3-D Secure. The issuer pushes a challenge to the cardholder's phone or app. Transactions that pass it shift liability away from the merchant.
- Tokenization. Wallets and stored-card checkout replace the card number with a token, so the merchant never holds the CVV.
- Velocity limits. Several attempts with different codes on one card trigger blocks at the processor, not just the issuer.
Pitfalls to avoid
- Never send your own CVV to a person over chat, email, or social media. No legitimate buyer or "verification agent" needs it.
- Avoid "card checking" or "CVV validator" tools. Running card numbers against a gateway to test validity is fraud even if no purchase completes.
- Do not photograph your card. Screenshots of cards are a top source of leaked codes.
- Reject sellers who demand crypto, gift cards, or off-platform payment before delivery.
- Treat any site that ranks for "buy CVV" as hostile. The organic result itself is the warning.
Protecting the CVV you already have
- Keep the card in a sleeve or wallet, and never leave it in a bag pocket where a camera can catch the back.
- Type the code only on pages that show a lock icon and the correct merchant domain.
- Turn on transaction alerts in your issuer's app so a card-not-present charge you did not make reaches you right away.
- Request a replacement card if a merchant you do not trust has seen the code.
- Use virtual numbers for subscriptions and unfamiliar sites so the real code stays private.