What the CVV/CVC code actually does
The CVV (Visa) or CVC (Mastercard) is the three-digit code on the back of most cards, or four digits on the front of American Express. It exists to prove the person typing the card number is holding the physical card. A merchant that requires the code gets one extra check that a stolen card number alone cannot pass.
That protection only holds if the code stays secret. Payment rules bar merchants from storing it after a transaction is authorized, which is why a competent checkout asks for it every time instead of remembering it.
Where card data actually leaks
- Skimming. A tampered card reader or gas-pump overlay copies the magnetic stripe and the keypad entry.
- Phishing and smishing. A fake bank or delivery notice collects the full card number, expiry, and code in one form.
- Merchant breaches. A compromised payment system exposes stored card numbers in bulk.
- Shoulder surfing and screenshots. A photo of a card in a chat thread is a full set of credentials.
Why "CVV shops" are never legitimate
No bank, processor, or retailer sells card verification values. A site advertising bulk CVVs is running one of two operations: it is fencing stolen financial data, which is a federal crime, or it is a straight scam that takes payment and delivers nothing. Buying from either one leaves you with no recourse, a payment trail tied to your name, and in the first case, liability for trafficking in stolen access devices.
Steps to protect your own card online
- Type the merchant's address yourself instead of following a link from an email or text.
- Check that checkout runs over HTTPS and that the domain matches the brand exactly.
- Use a virtual or single-use card number for unfamiliar sites when your issuer offers one.
- Never send a photo of your card, front or back, over chat, email, or social media.
- Keep the code covered when paying in person, and tug the reader at a pump or kiosk before inserting.
- Turn on transaction alerts so a charge you did not make reaches you in minutes, not on a statement.
- Review recurring charges monthly and cancel anything you do not recognize.
If your card data is exposed
- Call the number on the back of the card and ask for it to be frozen and reissued.
- Change the password on the account tied to the card, then enable two-factor authentication.
- Pull the last two statements and dispute every charge you did not authorize in writing.
- File a report at IdentityTheft.gov and keep the confirmation number.
- Report the fraud to the FBI's Internet Crime Complaint Center if a fake shop or phishing site took the data.
Card codes are a thin layer of defense, and they only work when nobody else has seen them. Treat the three digits the way you treat a password, and treat any offer to sell or buy them as the crime it is.