What the listing offers
A search for cheap CVV data priced in bitcoin returns pages that sell card numbers, expiration dates, and the three or four digit security code. The item for sale is a payment credential from a card that belongs to someone else. In the United States that trade is carding. Federal law covers it under 18 U.S.C. 1029, which sets penalties for trafficking in access devices.
The code is the CVV. Visa and Mastercard print three digits on the back of the card. American Express prints four digits on the front. Online merchants ask for it to confirm the buyer holds the physical card. That is the whole purpose of the code.
Why the cheap offers fail
Most listings at low prices are bait. The buyer sends bitcoin, the seller stops replying, and the transfer is final. Bitcoin has no chargeback and no dispute process.
- No refund. A bitcoin transfer cannot be reversed by the sender.
- Repeat sale. One card number can be sold to many buyers at the same time.
- Dead data. Issuers close a compromised account after the first fraud report.
- Exposure. Carding forums and marketplaces are watched in undercover operations. The FBI posts takedown notices through the IC3.
- Test charges. Small purchases used to test a card leave a record tied to the buyer.
A low price is a signal, not a discount. Stolen card data has no stable market price, and sellers who advertise the lowest rates carry the most risk for the buyer.
How issuers block stolen CVV use
Payment networks and banks run several checks when a card is used online.
- CVV verification. The merchant sends the code to the issuer for a match. A wrong code declines the charge.
- Address Verification Service. The issuer compares the billing street number and ZIP code against its file.
- 3-D Secure. The issuer asks the cardholder to approve the purchase in an app or with a one time code.
- Velocity and device checks. Issuers flag many attempts from one device or IP range in a short window.
- Tokenization. Apple Pay and Google Pay send a token, not the card number, so a stolen number has no use.
PCI DSS, the standard that governs card data handling, forbids merchants from storing the CVV after a transaction is authorized. That rule removes a common source of leaks.
What to do if a card number is exposed
- Call the number on the back of the card and ask for the card to be frozen.
- Dispute each charge in writing and keep the confirmation number.
- Request a new card number and a new CVV.
- File a report at IdentityTheft.gov and keep the recovery plan.
- File a complaint with the FBI IC3 if money was lost.
Controls a merchant can add
Require the CVV on every card not present order. Turn on 3-D Secure for high risk categories. Set rules that decline orders where the billing address and the shipping address sit in different countries. Log failed CVV attempts by device and review the count each week. Train staff to treat a rush request for same day shipping as a review item, not a priority.
Bottom line
There is no legitimate supply of CVV data for sale. A site that sells it is either a scam or a criminal market. Cardholders and merchants have legal routes that recover money and stop the charge: the issuer, the FTC, and the IC3. Bitcoin does not offer one.