What the code on the card does
A CVV is a three-digit code printed on the back of most Visa, Mastercard, and Discover cards. American Express prints a four-digit code on the front, called the CID. Issuers name the value by network: CVV2 for Visa, CVC2 for Mastercard, CID for American Express. The code is not written to the magnetic stripe or the chip. It proves the buyer holds the card, which matters when a merchant cannot see the card.
This page does not list markets, vendors, or payment routes. It covers what the listings claim, why the data fails, and what the law says.
What the listings are
Pages that advertise CVV data for bitcoin are fraud markets. Sellers claim to offer card records: number, expiration date, name, billing address, and security code. Three facts apply to all of them.
sell cvv cheap bitcoin dark web
- The data comes from breaches, skimmers, or phishing pages. Sale of it violates 18 U.S.C. § 1029.
- Most records fail. Issuers close and reissue cards once fraud is reported.
- Sellers reuse inventory. One record can go to many buyers, and the first successful charge kills the rest.
Low prices reflect that failure rate. A record priced at a few dollars is not a bargain, because the seller carries no cost for a dead number.
'Cheap CVV, Bitcoin Accepted' Listings Are a Trap
Checks that decide a card-not-present charge
Issuers and merchants score each transaction. These parameters control the result.
- CVV response: the issuer returns a match, no-match, or not-processed code. Some US merchants require a match. Some do not.
- Address Verification Service: compares the billing street number and ZIP code to issuer records.
- 3-D Secure: the issuer sends a challenge to the cardholder's device or app. A challenge that reaches the real cardholder stops the attempt.
- Velocity and device rules: fraud models score card number, IP address, device fingerprint, and time between orders.
These controls exist on the bank side. A seller cannot turn them off, and a buyer cannot see them before a charge runs.
Legal exposure in the United States
18 U.S.C. § 1029 covers access devices, a term that includes card numbers and security codes. The statute bans producing, selling, and possessing them with intent to defraud. A first offense carries up to 10 years; some subsections reach 15 or 20. Wire fraud (18 U.S.C. § 1343) and money laundering (18 U.S.C. § 1956) can be added to the same case.
Bitcoin payments leave a public ledger. US exchanges collect identity documents under FinCEN rules at 31 C.F.R. Part 1010. Chain analysis ties addresses to accounts, and a subpoena reaches the exchange.
Steps for cardholders
- Lock the card in the issuer's app. This blocks new charges at no cost. Unlock when you need it.
- Report unauthorized charges to the issuer. Federal law caps credit card liability at $50 under 15 U.S.C. § 1643, and most issuers waive it.
- File a report at IdentityTheft.gov if a card number, Social Security number, or account login is involved. Keep the report number.
- Ask the issuer for a new number if the security code may have leaked. Reissue ends the old code.
- Send a complaint to the FTC and to the IC3 if someone offered card data to you.
Card networks and issuers publish the same guidance. The code is a single check among several, and no listing on a dark web forum changes how the bank scores a charge.