What a CVV dump actually is
A CVV dump is a bundle of stolen payment card records, packaged and sold in bulk. Each record typically holds a card number, expiration date, the cardholder's name, and the three or four digit verification code printed on the card. The word "dump" refers to the volume: sellers move hundreds or thousands of records at once, often sorted by issuing bank, country, or card brand so a buyer can grab a specific slice.
Dark Web CVV Dump Shops: What They Are and How to Protect Your Card
You will not find these on a normal website. They circulate on dark web markets and private chat channels, and the people buying them are not shopping for groceries. For anyone with a debit or credit card, the practical question is simpler: how does a code that only exists on a piece of plastic end up in a file like that?
CVV Dump Format and Track Data: What Merchants Must Know
Why the CVV is the valuable part
Card numbers leak all the time. Breach after breach spills account numbers and expiration dates, and on their own those are not worth much because most checkouts ask for the verification code too. That is the whole point of the CVV. It is a short shared secret that proves whoever is typing has the card in hand, not just a copy of the number from some database.
Under the PCI Data Security Standard, merchants and processors are not allowed to store the CVV after a transaction is authorized. So a dump cannot come from a well-behaved checkout system that simply kept the code. It comes from somewhere the code was captured in motion or harvested from the cardholder directly.
Dumps, fullz, and BIN lists
- Dump: track data or card number plus CVV, expiration, and often name. Enough for a card-not-present purchase.
- Fullz: a broader identity package, adding things like address, phone, and sometimes SSN. Used for opening accounts, not just buying.
- BIN list: just the first six to eight digits of a card number, which identify the bank and card type. Not usable alone, but a starting point for guessing.
How the codes get lifted
Most stolen verification codes come from a handful of familiar places. Skimmers glued over gas pump and ATM card readers. Phishing pages that look like a bank login or a shipping notice. Malicious scripts injected into small ecommerce sites, which quietly copy what a shopper types into the checkout form. And plain old social engineering, where someone calls, texts, or emails pretending to be your bank or a store's fraud department and asks you to "confirm" the code on the back of your card.
I look for that last one constantly, because it needs no technical skill at all. Nobody legitimate will ever ask you to read your CVV aloud over the phone.
Why the CVV check still stops most of it
When you enter a card online, several checks run at once. Address verification compares your billing zip and street number to what the issuer has. The CVV match is a separate yes or no. Modern fraud systems also look at device, IP, order velocity, and whether the card has been seen before. Add 3D Secure, where your bank sends a push or one-time code, and a raw dump has a hard time completing a purchase.
This is also why scammers start small. A one dollar test charge tells them the card is live before they try something bigger. If a tiny charge shows up that you do not recognize, do not wait for the next one.
Protecting your own card
- Turn on transaction alerts in your banking app so every charge pings your phone.
- Use virtual or single-merchant card numbers when your bank offers them. A leaked number that only works at one store is a dead end.
- Skip saving cards in browsers and random shopping accounts unless you trust the site and use a unique password.
- Cover the keypad at gas pumps and ATMs, and pay inside when a reader looks loose or taped.
- Give your CVV only inside a checkout page you reached by typing the address yourself.
If your card ends up in a dump
Call the number on the back of your card, not a number from an email. Ask for a replacement with a new number, and dispute any charge you did not make in writing. Check your statements for a few months after, since some fraudsters sit on stolen data before using it. Then file a report with the FTC and, if money was actually taken, with the FBI's Internet Crime Complaint Center. Replacement plastic is cheap. Cleaning up a drained account is not.