What the CVV does at checkout
A card verification value is a 3-digit code on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The code is not held in the magnetic stripe or the chip. A merchant sends the code to the card issuer during authorization. The issuer returns a match or no-match result. The code shows the person typing knows the physical card.
Pick first: tokenized checkout with 3-D Secure
This is the first choice. The merchant never stores the card number or the CVV. A payment processor replaces the card number with a token. The issuer confirms the cardholder with a one-time code or a banking app prompt. Card data stays out of the merchant database. A breach at the merchant then yields tokens, not card numbers.
The three common setups
- Tokenized checkout plus 3-D Secure. Card data goes to the processor. The merchant stores a token. Fraud liability shifts to the issuer when authentication passes.
- Direct post to a PCI DSS Level 1 processor. The merchant passes fields to the processor page. No card data touches merchant servers.
- Card data on the merchant server. The merchant holds the number and the CVV. PCI DSS forbids storage of the CVV after authorization. This setup carries the most risk.
Why "CVV shop review and rating" pages fail a basic check
Sites that sell card numbers and CVV codes are criminal marketplaces. 18 U.S.C. 1029 makes trafficking in card credentials a federal crime in the US. These sites take cryptocurrency, ship nothing verifiable, and close without notice. Review pages for them are written by the same operators. There is no auditor, no regulator, and no refund path. Ratings on those pages cannot be checked against any independent source.
What to check on a real checkout page
- The URL uses HTTPS and the certificate matches the domain.
- The page names the processor: Stripe, Adyen, Braintree, Worldpay.
- The form asks for the CVV and does not offer to save it for next use.
- The site posts a privacy policy that names the data it keeps and the period.
- The site lists a phone number and a mailing address.
If a card number is exposed
Call the issuer. The number on the back of the card reaches the fraud line. Ask for a new card number. The issuer voids the old number. Check statements for small charges, which come first in many cases. File a report at IdentityTheft.gov if the data was used to open accounts.