Advice first: that market does not work the way the ads claim
If you are looking for someone who will sell CVV online on the darknet cheap, two things are true at the same time. Buying card data you do not own is a federal crime in the US, and the storefronts advertising it are built to take your money, not to hand over a working card number.
Selling CVVs on the Dark Web: Why 'No Scam' Offers Are Always Fraud
I have read plenty of those listings. Screenshots of "fresh" cards, vendor ratings, escrow promises. The whole layout exists to make a $20 payment feel safe. Then the shop goes dark, or the numbers you get were used a hundred times already and fail on the first authorization attempt.
Why the word cheap is the giveaway
Card data has a cost that tracks the balance behind it. Anything priced low and sold in bulk on a public forum tends to be junk: recycled numbers, expired bins, or strings someone invented in a text file. The scam script is boringly consistent. A slick shop, a minimum deposit, a support rep who needs more crypto to "unlock" your order. Some of these sites are also credential harvesters, so a buyer who signs up with a real email and a reused password gives away more than a wallet balance.
These spaces get watched. Trafficking in unauthorized access devices carries serious penalties under 18 U.S.C. § 1029, and prosecutions run through the FBI and the Secret Service as a matter of routine. A charge is not a rare risk of the trade. It is the normal ending.
How the CVV actually works, and why that matters to you
The three digits on the back of a Visa or Mastercard, and the four on the front of an Amex, confirm that whoever is typing is holding the physical card. That is the entire design. PCI DSS rules forbid merchants from storing the code after authorization, so a properly built checkout asks once and keeps nothing.
- Visa, Mastercard, Discover: three digits, back of the card.
- American Express: four digits, front, above the card number.
- No legitimate business asks for your CVV by email, chat, or text.
Parameters worth checking before you type your own code
Look for a checkout that runs over HTTPS with a padlock and a domain that matches the brand. Address Verification Service should be active, meaning the billing address you enter gets checked against the issuer. A 3-D Secure prompt that sends you to your bank's own page is a good sign. A prompt that asks you to type your banking password into the shop's page is not.
Virtual card numbers from your issuer are the strongest practical defense. You get a one-time or merchant-locked number, so a breach at the shop exposes nothing reusable. Set transaction alerts as well. A card testing attack usually shows up as a string of tiny charges, one or two dollars, right before a large one.
Pitfalls that catch careful shoppers
- Fake checkout pages on lookalike domains, often one character off from the real store.
- "Verify your card" messages after an order, sent by email or SMS, asking for the full number and CVV again.
- Browser extensions and saved-card features that store the code when they should not.
- Marketplace sellers who want payment off-platform, where no dispute process exists.
If your card details do leak, call the issuer and ask for a replacement number. Report the incident to the FTC and to the IC3. You are not obligated to prove anything to anyone before the card gets frozen.
The short version
There is no safe, cheap way to buy someone else's card data, and the listings promising one are usually aimed at the buyer's wallet. Your own CVV is worth more than any bargain on a darknet shop page. Guard it, use virtual numbers where you can, and treat every unsolicited request for those digits as an attack.