What a CVV is
CVV stands for card verification value. Visa, Mastercard, and Discover print three digits on the back of the card. American Express prints four digits on the front. The issuer generates the number and ties it to the account. The digits do not appear in magnetic stripe data or chip data, so a card number copied from a terminal or a skimmed stripe does not include them.
What a cheap CVV shop sells
A CVV shop is a marketplace that sells card records: the account number, the CVV, the cardholder name, the billing address, and sometimes the issuer phone number. The stock comes from data breaches, skimmers, and phishing pages. Sellers do not hold the accounts. Listings sell for cents to tens of dollars each, and payment runs through cryptocurrency. No shop in this category holds a merchant agreement with a card network. The goods are stolen payment credentials, and the buyer is a party to the theft.
The legal position
In the United States, 18 U.S.C. section 1029 covers the sale and purchase of card data. Trafficking in one unauthorized access device carries a maximum of 10 years. The maximum rises to 15 years when the offense involves a set of devices or devices obtained through a breach. Prosecutors charge buyers along with sellers. A record bought for two dollars can support the same charge as a record bought for two hundred.
Why the cards fail at checkout
- Issuers block card-not-present orders from IP addresses that do not match the account history.
- The address verification service compares the billing street number and ZIP code. A mismatch triggers a decline or a manual review.
- 3-D Secure sends a one-time passcode to the cardholder phone. The buyer does not control that phone.
- Cardholders file chargebacks within days. The shop has already been paid.
For merchants
- Require the CVV on every card-not-present order.
- Run address verification and decline ZIP mismatches.
- Turn on 3-D Secure for high-risk orders.
- Set velocity limits on cards, IPs, and devices.
For cardholders
- Read the statement each week.
- Freeze the card in the issuer app when a charge looks wrong.
- Report unauthorized charges to the issuer. Regulation Z caps credit card liability at 50 dollars.
Legitimate processors and merchants do not sell CVV data. A low price on card records signals stolen stock, not a bargain.