What the term covers
CVV2 and CVC2 are three-digit codes on the back of most Visa, Mastercard, and Discover cards. American Express prints a four-digit code on the front. The code proves that the person entering a card number holds the card. Carding means using card data that belongs to someone else to buy goods or move funds. A listing for "cheap CVV" sells records: card number, expiration date, cardholder name, and in some cases the security code. The seller holds no risk after payment.
No regulator publishes prices for stolen card data. Court filings in carding cases cite per-record amounts of a few dollars, and bulk sets of 100 records or more at a lower unit cost. Those figures come from prosecutions, not from a market index.
Buy Cheap CVV 2024: Fraud Risk and Safer Payment Options
Why the buyer is the second target
Carding forums follow a known pattern. The operator collects payment first. The record fails at checkout, or the merchant cancels the order. The buyer asks for a replacement and gets removed from the forum. Buyers do not report the loss, because the purchase was against the law. There is no chargeback for a stolen record.
FBI and DOJ case releases describe operations in which administrators also used the buyer's own credentials and payment details. The buyer hands over a working card number to buy a dead one.
Legal exposure in the United States
18 U.S.C. 1029 covers fraud and related activity with access devices. Trafficking in an unauthorized access device carries up to 10 years. Possession of 15 or more devices with intent to defraud carries up to 10 years. Making or trafficking device-making equipment carries up to 15 years. Sentences add up: prosecutors stack counts, and 18 U.S.C. 1028A adds a two-year term that runs after the other sentence. A first offense can produce a prison term even when the dollar loss is small.
Civil suits follow criminal cases. Issuers and merchants pursue restitution.
Who pays for a stolen card number
Credit card holders have a $50 maximum liability for unauthorized charges under the Fair Credit Billing Act. The FTC states that figure. Debit card rules differ: $50 if the loss is reported within two business days, up to $500 after that, and more if the report comes later than 60 days. So the cardholder pays little. Issuers, merchants, and processors carry the loss, plus chargeback fees and card replacement costs.
Controls that stop card-not-present fraud
- CVV handling. PCI DSS bars merchants from storing the security code after authorization. If a site keeps the code, a breach exposes it.
- 3-D Secure. The bank checks the purchase with the cardholder. When authentication passes, liability shifts to the issuer.
- Network tokens. The card number is replaced with a token that works at one merchant.
- Transaction alerts. Issuer apps send a message for each charge. The first report closes the card.
- Virtual card numbers. A single-use number limits where a leaked number can be used.
Pitfalls to check before you trust any card-data claim
- No verification source. There is no public index of validity rates. A seller can claim any rate.
- Payment method. Carding sites take crypto. There is no refund path and no dispute process.
- Hosting churn. Sites move domains after takedowns. The new site keeps the old reputation and none of the obligations.
- Data age. Breach dumps get reshuffled and resold. Older records fail more often.
- Your own exposure. The account you use to pay links your identity to the purchase.
If your card data is exposed
Call the issuer and ask for a new number. Report the charges in writing within 60 days. Check the card agreement for the liability terms that apply to the product. For credit cards, the maximum is $50. For debit cards, the report window sets the cap.