The listing is the scam, not the deal
If you go looking for a market that advertises CVVs cheap, you will find pages. Most are fake shops running a simple trick: they take a payment for card data that either does not exist or stopped working weeks ago. Some are run by the same people who later call you as "fraud prevention" and ask you to confirm the three digits on the back of your card. Cheap is the bait. A real stolen card number has a short shelf life, so prices in those shops are always a gamble dressed up as a bargain.
how to sell cvv cheap on dark web
There is a second problem. In the US, buying or selling account numbers and CVVs falls under access device fraud, 18 U.S.C. § 1029. The people selling have no reason to protect your identity, and plenty of buyers end up with a card that was already reported stolen, which is how the fraud gets traced.
What you can actually control is your own card. I check my bank's app after every card-not-present purchase, and the settings below are the ones worth knowing.
What those shops are really selling
- Bulk dumps. Lists sold by the thousand, priced low because a small slice still works. Nobody validates them for you.
- Dead BINs. Cards from a bank that has since tightened checks or blanked the numbers.
- Refund theater. Support that asks for a "test" purchase to prove a card is dead. That request is the point.
- Phishing bait. A site that wants your email, your own card, or a deposit in crypto before it shows you a catalog that does not exist.
Parameters that protect your card at checkout
- CVV length and placement. Visa, Mastercard, and Discover use three digits from the back; American Express uses four from the front. A form that asks for anything else is worth closing.
- Never store the CVV. PCI DSS forbids merchants from keeping the CVV2 after authorization, and your own notes app should follow the same rule. If a merchant keeps it, that is a red flag, not a convenience.
- Virtual card numbers. Most US issuers will generate a one-time or merchant-locked number in their app. I use these for subscriptions and for sites I have not bought from before.
- 3-D Secure prompts. The extra code at checkout is annoying until the one time it stops a charge you did not make. Leave it turned on.
- Card controls. Turn off international and online use when you are not shopping. Set a spend limit. Freeze the card when it is idle.
- AVS and tokenization. Merchants that check your billing address and store a token instead of your number are doing the basic work. Tokenization means the shop never holds the CVV at all.
Pitfalls worth avoiding
Do not email card details to a seller or "processor," even if the message looks like it came from your bank. Do not type a CVV into a chat window for a deposit or a "verification." Do not reuse the same password across shopping sites. Skimmers on gas pumps and card readers copy the number and the PIN, and no amount of care online fixes a card that was cloned at the pump.
If a charge shows up that you did not make, freeze the card in the app, call the number on the back of the card, and report it. The FTC and the FBI's IC3 both take card fraud reports, and the report is what builds the case if the charge is part of a larger operation. Cheap card data has a real cost. It is just paid by someone else, until it is paid by you.