What a CVV is
A CVV is a 3-digit code printed on the back of most cards. American Express prints a 4-digit code on the front. The issuer generates it from the card number, expiry date, and a secret key. The code proves the person entering the number holds the card.
A CVC is the same thing under a different name. Visa calls it CVV2. Mastercard calls it CVC2. The function does not change.
What cheap CVV shop listings are
Sites that advertise low-cost CVV data sell card numbers taken from breaches, skimmers, and phishing pages. The data is stolen property. A low price does not make the transaction legal or safe.
Common traits in these listings:
Buying CVV Shop Cheap Dumps: A Comprehensive Guide
- Payment in cryptocurrency, which has no chargeback path.
- No verification of the card before sale.
- No refund when the number declines.
- Bulk files with numbers already used or already reported by the cardholder.
Prices are low because the data has a short life. Issuers block a compromised number at the first failed attempt.
Legal exposure in the US
18 U.S.C. 1029 covers fraud and trafficking in unauthorized access devices. A card number plus its CVV counts as an access device. Penalties reach 15 years in prison and fines up to $250,000 for a first offense on some counts. State laws add separate charges. Card networks and processors log authorization attempts and report patterns to law enforcement.
Why the data fails in practice
Card issuers run fraud models on every authorization. A new merchant, a new device, and a mismatched billing address raise the score. The issuer declines the charge. Address Verification Service checks the billing street number and ZIP code against the issuer record. A stolen CVV does not carry the matching address.
3D Secure adds a second step. The issuer sends a one-time code to the cardholder phone. The buyer of stolen data cannot complete that step.
How merchants protect CVV data
PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after authorization. That includes the full track data, the CVV, and the PIN block. Merchants who accept cards must not keep the CVV in any database, log, or backup.
Tokenization replaces the card number with a surrogate value. The real number stays in the processor vault. A breach of the merchant system then yields tokens with no use outside that merchant.
If your card data is exposed
Call the number on the back of the card and ask for a freeze or a replacement. Review statements for small test charges of $1 or less. Report identity theft at IdentityTheft.gov. Report card fraud to the FBI Internet Crime Complaint Center.
Unknown: the exact number of active CVV shops. Listings appear and close within days, and no public registry tracks them.