A CVV dump is a record of stolen payment card data, and its "track data" follows the magnetic stripe layout standardized in ISO/IEC 7813. Track 1 holds the cardholder name, primary account number (PAN), expiration date, service code and discretionary data. Track 2 holds the PAN, expiration date, service code and the discretionary value that carries the card verification value (CVV1) used when a physical card is swiped.
For merchants and security teams, the value of knowing this format is defensive. It makes leaked data recognizable in logs, breach dumps and fraud investigations, and it explains which fields attackers want and why.
What does a CVV dump contain?
A CVV dump typically lists the PAN, expiration date, cardholder name and the verification values tied to the card. Dumps are often described by the fields they include, such as "fullz" (name, address, PAN, expiration, CVV2, sometimes a Social Security number) or track data only.
No legitimate payment professional needs to buy, sell or hold a dump. Possessing or trafficking stolen card data is a federal crime in the United States under 18 U.S.C. 1029.
What is the track data format?
Track data is the encoded string written to the magnetic stripe and, on chip cards, represented by equivalent EMV data elements. ISO/IEC 7813 defines the field order, separators and start/end sentinels for Tracks 1 and 2.
Track 1 fields
- Format code (B)
- Primary account number, up to 19 digits
- Field separator (^)
- Cardholder name in surname/first name order
- Expiration date in YYMM format
- Service code (three digits)
- Discretionary data, which can include CVV1 and PIN verification values
- End sentinel (?)
Track 2 fields
- Start sentinel (;)
- Primary account number
- Field separator (=)
- Expiration date in YYMM format
- Service code
- Discretionary data including CVV1
- End sentinel (?)
Track 3 exists in some standards but is rarely used on modern payment cards.
How is CVV1 different from CVV2 and CVC?
CVV1, sometimes called CVC1, is encoded in the discretionary data of the stripe and is checked only when a card is physically presented. CVV2 (Visa) and CVC2 (Mastercard) are the three or four digit values printed on the card and used for card-not-present transactions. American Express uses a four-digit CID in both contexts.
Why does track data matter for online purchase security?
Online merchants never see track data. A card-not-present transaction relies on the PAN, expiration date and CVV2, which is why fullz dumps are so damaging: they supply every field needed to pass a basic checkout.
That is also why CVV verification, address verification (AVS) and 3-D Secure exist. Each adds a check that a leaked static data set alone cannot satisfy.
How can merchants reduce card-not-present fraud?
- Require CVV2 on every card-not-present authorization and decline mismatches.
- Use AVS and route high-risk mismatches to manual review.
- Enable 3-D Secure 2 for issuer-side authentication and risk signals.
- Tokenize stored card data so PANs never sit in your database.
- Never store sensitive authentication data such as full track data or CVV after authorization, as PCI DSS requires.
- Monitor velocity, device fingerprints and BIN or country mismatches.
Is it legal to possess CVV dumps or track data?
No. In the United States, trafficking in or possessing unauthorized card data with intent to defraud is prosecutable under 18 U.S.C. 1029, with penalties that include prison time and fines. Merchants may process track data only in the moment of authorization and must not retain it.
What should consumers do if their card data is exposed?
Freeze the card through the issuer's app, dispute unfamiliar charges and request a replacement number. Turn on transaction alerts and watch for small test charges, which are often used to validate a stolen dump.