The short answer
There is no legitimate buyer's market for CVV or CVC data. Any website that advertises card verification values, dumps, or full card details for sale is a criminal marketplace, and the only sound buying decision is to stay away from it entirely. The useful question is not how to buy from such a site but how to recognize one, how to keep your own card data out of it, and how to judge whether a merchant you actually shop with handles verification values correctly. Card verification values exist to prove the physical card is present or known to the holder, and a merchant that stores or resells them has already broken the rules that protect you.
What a "CVV selling site" actually is
Carding forums and storefronts trade stolen card numbers, often bundled with the three or four digit verification value, the expiry date, and the cardholder's name and billing address. Sellers call these bundles by names like fullz or dumps. The inventory comes from skimmers on fuel pumps and ATMs, phishing pages that clone a checkout, breaches at merchants that mishandled data, and malware on consumer devices. None of it is consensual, and none of it is legal in the United States or anywhere else.
These operations are also unreliable on their own terms. Research from federal cybercrime reporting has long shown that carding marketplaces are saturated with exit scams, fake escrow services, and repeat victimization of the buyers themselves. A person who sends funds to such a site has no recourse and has documented intent to commit fraud. Law enforcement monitors these venues, and account data shared on them becomes evidence.
Why card verification values matter in a real checkout
The verification value is a check digit computed from the card data. When a merchant submits an authorization request, that value travels with it so the issuer can confirm that whoever is transacting has the card in hand. The value has a deliberate design limit: it is not meant to be retained. Payment card industry rules prohibit storing the verification value after authorization, which is why a well-built checkout asks for it every time and a badly built one cannot.
What to look for in a merchant's checkout
- Hosted or iframed payment fields. The card number and verification value should be entered in fields served by the payment processor, not by the shop's own servers.
- Strong Customer Authentication. EMV 3-D Secure prompts your bank for a confirmation step on higher-risk orders. Expect it on new devices and unusual amounts.
- Tokenization. Repeat purchases should reference a token, not replay your stored card number. A merchant that shows your full card number in your account page is a red flag.
- Address Verification Service. The billing address you enter should be checked against the issuer's records. Mismatch handling is a sign of a real risk engine.
- Plain evidence of compliance. Look for a current PCI DSS attestation statement, a named acquiring bank, and a published privacy policy that describes retention periods.
- Clear dispute path. A refund and chargeback process that does not require you to email card details is a basic marker of a functioning merchant.
Security bands to judge a checkout against
Think in three tiers. A baseline checkout uses TLS everywhere, redirects or iframes card entry to a processor, and never asks for the verification value by email or chat. A solid checkout adds 3-D Secure on risky orders, tokenized storage, and AVS with a documented review process. A mature checkout adds device fingerprinting, velocity limits on repeated card attempts, and a fraud team that reviews mismatches before shipping. If a shop you are considering sits below the baseline, buy elsewhere.
Common pitfalls
- Treating a padlock icon as proof of safety. TLS protects the connection, not the merchant's handling of your data.
- Reading a verification value aloud on a phone call or typing it into a chat window. No legitimate order flow needs that.
- Reusing one password across shopping accounts. Credential stuffing is a leading source of card-on-file theft.
- Assuming small merchants are safer. Small shops are often the ones with unpatched carts and no fraud review.
- Ignoring small unauthorized charges. Test charges usually precede larger ones.
If your card data may have been exposed
- Freeze the card in your banking app or call the issuer and request a replacement with a new number.
- Change the password on any shopping account that stored the card, and enable multi-factor authentication.
- Review statements for the past 60 to 90 days and dispute anything you do not recognize.
- Place a fraud alert or credit freeze with the major bureaus if your identity details were also exposed.
- Report the incident to the FTC and to the FBI's Internet Crime Complaint Center.
FAQ
Can I safely buy a card verification value for testing?
No. Test data comes from payment processors and sandbox environments, never from live cards. Use a processor's official test card set instead.
Is it illegal to visit a carding site?
Visiting is not the same as transacting, but purchasing, possessing, or using stolen card data is a federal offense in the United States. Do not register, log in, or send funds.
Why do some sites ask for the code twice?
Usually a retry after a failed authorization, or a poorly designed form. A second capture can indicate the merchant is retaining the value, which the rules forbid.
Does 3-D Secure stop all fraud?
It reduces card-not-present fraud substantially by shifting liability, but it does not replace merchant-side review of address mismatches and order velocity.