Start with the obvious: nobody legitimately sells CVVs
A CVV is three or four digits printed on a card. It has no independent value, no warranty, and no legitimate seller. Any market pricing it at a couple of dollars is selling stolen data, a fabricated number, or nothing at all. Usually all three in rotation.
So treat any page promising to sell CVVs cheap as a security question, not a shopping question. The useful thing to learn is how the pitch works, because the same playbook gets aimed at ordinary shoppers every day.
What the listings are actually made of
Most of these storefronts run on one script: a throwaway site, a batch of sample numbers posted to build trust, payment in crypto, and refunds that only arrive if you buy more. The samples are usually generated with a correct Luhn checksum so they pass a format check, then paired with invented expiry dates. A number that validates proves nothing about whether it exists.
The second layer is worse. A site built to sell card data also collects wallet addresses, IP logs, and whatever identity details a buyer volunteers. People who pay for a CVV show up weeks later with their own accounts under attack.
If you landed here because a charge looked wrong
- Freeze the card in your banking app. Most issuers let you toggle it off in seconds.
- Call the number on the back of the card, not a number from a search result or an email.
- Ask for a new card number, not just a reversal. A reversed charge on the same number leaves the data live.
- Scan for small recurring charges you don't recognize. Test runs come before big ones.
Parameters worth checking before you type a CVV anywhere
This is the part that pays off. When you are the one entering card details, the site in front of you is the only thing that matters.
- Who processes the payment. A real merchant hands off to a named processor. Checkout that asks for card number, expiry, and CVV with no processor, no privacy page, and no physical address is a stop sign.
- Whether the CVV field is allowed to persist. PCI DSS forbids storing the security code after authorization. A site that pre-fills your security code on a return visit is non-compliant or lying. Pre-filled card numbers are normal. Pre-filled CVVs are not.
- Virtual cards for unfamiliar merchants. Major issuers and several fintechs issue one-time or merchant-locked numbers. If the store turns out to be junk, the damage is capped.
- HTTPS plus a reachable address. The padlock is table stakes, not a guarantee. Pair it with a phone number and a return policy you can read in full.
- Price sanity. Deep discounts on physical goods are the oldest card-testing lure there is. The listing at 70 percent below everyone else is often funded with stolen numbers, and your order is the laundering step.
Pitfalls
- Treating a checksum-valid number as proof of anything.
- Paying by crypto, gift card, or wire for goods. No chargeback, no recourse.
- Trusting a screenshot of a balance checker. Screenshots cost nothing to fake.
- Entering your own card into a site that asks you to verify it. Card verification scams harvest exactly the code you are trying to protect.
Bottom line
There is no cheap and safe way to buy someone else's card data, and the people offering it are running a collection funnel, not a store. Protect the card you already have: freeze fast, replace the number rather than just reversing the charge, use virtual cards with new merchants, and read any offer of a cheap CVV as a pitch aimed at your own data.