There is no legitimate market for buying CVV numbers. That three or four digit code on the back of a payment card exists for one purpose: to prove the physical card is in the buyer's hand during a card-not-present transaction. Banks, processors, and merchants do not sell it as a standalone product, and any storefront advertising cheap CVV stock is running an advance-fee scam, harvesting the buyer's own card details, or fencing stolen data, which is a federal offense in the US under 18 U.S.C. 1029. The real buying decision is therefore about where you shop and how your code is handled: pick merchants that never ask for the CVV outside a secured checkout, and treat every off-channel request for it as hostile.
What to look for in a checkout you can trust
- Direct card entry only. A merchant should collect the CVV inside its own hosted payment form or a processor-hosted iframe, never by email, chat, phone, or a form on a different domain.
- Visible processor branding and a redirect or iframe you can identify. You should be able to tell whose payment page is collecting the data.
- Tokenization. After the first purchase, the merchant should reference a token, not your full card details, and should still ask for the code on repeat orders where the card is not present.
- Step-up authentication. Expect a 3-D Secure challenge on higher-risk or higher-value orders. A merchant that never triggers one on a new device is not protecting you.
- Clear refund and dispute path. Documented chargeback handling is the strongest signal of a real business.
Parameter bands to judge a merchant or payment setup
- Baseline: PCI DSS v4.0.1 compliant, CVV collected on-page, no storage of the code after authorization.
- Solid: hosted payment fields plus network tokenization, so the merchant's servers never touch the raw card number or code.
- Strong: tokenization paired with 3-D Secure 2 and device fingerprinting, with risk rules tuned per order value.
- Weak, avoid: custom checkout forms on the merchant's own server, CVV requested by message, or a payment page that asks for the code after the order is already placed.
Pitfalls that cost people money
The most common trap is a "verification" message claiming your order is on hold until you send the code. Genuine processors do not do this. A second trap is a discount offered in exchange for a photo of your card, including the front and back. A third is any merchant that stores the CVV so you can check out faster later, which PCI DSS explicitly forbids after authorization. Card-testing attacks also hit small shops hard: a burst of low-value orders from one IP range usually means someone is validating stolen numbers, and those orders should be blocked rather than fulfilled. Finally, if you run a store, never let the code land in logs, support tickets, or analytics events, because that single mistake turns a routine support chat into a breach.
FAQ
Is buying CVV numbers legal anywhere in the US?
No. Selling or possessing card verification values tied to accounts you do not own falls under access device fraud statutes, and the buyer is as exposed as the seller.
Why did a shop ask me for the code in an email?
Because it is either poorly run or not a real merchant. Reply with a request to cancel and buy elsewhere.
Can a merchant save my CVV for next time?
No. PCI DSS prohibits storing the code after authorization under any circumstances, even encrypted.
What should I check before entering my code?
Confirm the domain, confirm the payment page belongs to a known processor, and confirm the connection is secure. If any of the three is unclear, stop.