What the CVV code is
The CVV is a 3-digit code printed on the back of most cards. American Express prints a 4-digit code on the front. The full name is Card Verification Value. Mastercard calls its version CVC, Card Verification Code. Issuers generate the code from the card number and other account data at the time the card is issued.
The code serves one purpose: it shows that the person at the checkout holds the physical card. A thief who copies the 16-digit card number and nothing else lacks the code.
How to Buy High-Quality CVV/CVC for Secure Online Purchases
How online merchants handle the code
An online store asks for the code during checkout. The store sends it to the payment processor with the authorization request. The issuer compares it to the code on file and returns a match or a mismatch.
PCI DSS Requirement 3.2 bars merchants from storing the code after authorization. That rule is why a saved card on file needs the CVV re-entered, or needs a token instead of the card number.
Cheap Fresh CVV Fullz 2024: Scam Warning, Not a Buying Guide
A mismatch does not always mean fraud. Typing errors happen. Issuers and processors set their own limits on retries.
Why "CVV for sale" listings are fraud
Sellers who advertise CVV data for sale offer stolen card details. The data comes from skimmers, breaches and phishing pages. Using it to buy goods is card fraud. In the US, 18 U.S.C. Section 1029 covers access device fraud, and a conviction carries prison time and fines.
These listings also tend to be scams against the buyer. Common patterns: the seller takes payment and sends nothing, sends dead card numbers, or sends numbers tied to closed accounts. Some listings exist to set up a second fraud, such as a fake escrow site.
No legitimate seller offers CVV data. Banks do not sell it. Processors do not sell it. A cardholder cannot transfer a code to another person for use.
Parameters to check on the merchant side
- CVV requirement: the checkout must ask for the code on each new card entry.
- AVS: Address Verification Service compares the billing address to the issuer record.
- 3-D Secure: an extra authentication step through the issuer, sold as Visa Secure or Mastercard Identity Check.
- Tokenization: the store keeps a token, not the card number.
- Card-on-file rules: no CVV storage, re-authentication on a new device.
Pitfalls for cardholders
- A site that asks for the CVV by email or chat. No store needs that.
- A checkout page without HTTPS. Leave it.
- Saved cards on a shared device. Remove them.
- Photos or screenshots of the card back. Delete them.
- Lookup tools that promise to verify a card for a fee. These take payment and return nothing.
Steps if a code is exposed
Call the issuer. Ask for a replacement card and a new number. Review recent charges. Report the fraud to the FTC and to the FBI Internet Crime Complaint Center. Under US law, a cardholder faces a $50 cap on liability for unauthorized use of a credit card, and many issuers waive that amount.
What a buyer can verify before paying
The code itself says nothing about whether a seller is honest. Buyers who want a safer transaction should check the merchant's return policy, the billing descriptor, and the dispute process. Card networks publish chargeback rules that apply to card-not-present orders.