What a CVV dump is
A CVV is the 3 digit code printed on the back of a Visa, Mastercard, or Discover card. American Express prints 4 digits on the front. The code proves the person entering card data holds the physical card. Card networks call it a card verification value. Issuers call the printed code CVV2 or CVC2.
CVV Security on Telegram: How to Protect Your Own Card
A dump is a record of card data copied from somewhere else: a payment terminal, a merchant database, or a breach. Sellers on carding forums advertise records with the card number, expiration date, cardholder name, and printed code. The pitch is that a buyer can run card-not-present transactions online.
Why buying a dump is a federal crime in the US
18 U.S.C. § 1029 covers access device fraud. Buying, selling, transferring, or using another person's card data without permission is a crime. Penalties reach 10 years for a first offense, and 15 years for offenses involving more than one access device or $1,000 in value in a 12 month period. Prosecutors stack counts. One indictment can list dozens of cards.
The Department of Justice files these cases each year. Sentences include prison time and restitution orders. Card data in a text file, a photo, or a chat log is evidence.
Most sellers are running a fraud
Sellers on carding markets have no legal duty to deliver. A buyer cannot call police, dispute the payment, or sue. Research on underground forums finds that a large share of sellers never send working data, and exit scams are routine. Card data also goes stale. Banks cancel cards after a breach or a fraud report, so a record bought in 2024 can be dead within days.
What actually reduces card-not-present fraud
- Never store the printed CVV. PCI DSS Requirement 3.3.1 prohibits retention after authorization.
- Run 3-D Secure or a comparable step on high-risk orders so the issuer verifies the cardholder.
- Check billing address, delivery address, and order velocity. Card testing appears as many small declines.
- Cardholders report fraud to the issuer, then file a report at IdentityTheft.gov, then contact the FBI IC3 if a pattern continues.
Bottom line
There is no legal market for CVV dumps in the US, and no reliable one anywhere. The purchase itself is the offense, the seller is unaccountable, and the data has a short shelf life. Merchants and cardholders cut losses with CVV storage bans, issuer authentication, and fast fraud reports.