"CVV dumps for sale" refers to stolen payment card data — card numbers, expiration dates, and CVV/CVC verification codes — offered through criminal marketplaces. Buying, selling, or using that data is payment card fraud under statutes such as 18 U.S.C. § 1029 in the United States, so there is no legitimate vendor, no lawful buying guide, and no consumer protection if a transaction goes wrong.
What the phrase actually describes
In fraud communities, "dumps" usually means magnetic-stripe track data, while "CVV" or "fullz" listings bundle the card number with the security code and cardholder details. The data comes from skimmers, merchant breaches, phishing kits, and fake checkout pages. It is then resold, often several times, to different buyers. From a security standpoint, every listing represents a real person whose account is about to be abused, and every purchase is evidence of intent to commit fraud.
Why there is no legitimate buying guide
Search results promising tutorials, vendor reviews, or "trusted shops" are themselves part of the fraud economy. The traps are consistent:
- Criminal liability. Attempting to purchase stolen card data can be charged as access device fraud, and using it adds identity theft and wire fraud exposure.
- Advance-fee scams. Most listings demand cryptocurrency up front with no escrow, no refund, and no recourse. The seller disappears, or the data is fabricated.
- Dead or duplicated data. Codes are invalidated the moment a card is reissued, and the same record is frequently sold to multiple buyers, so a card is usually blocked before it is used.
- Compromised buyers. Marketplaces and the tools around them are a common delivery route for malware and credential theft, so buyers often lose their own accounts.
- Monitoring. Card networks, issuers, and law enforcement actively watch these channels and the test transactions that follow.
For merchants: the CVV/CVC parameters that matter
If your goal is protecting card-not-present revenue rather than acquiring stolen data, the controls are well documented and legal. Configure these in your payment stack:
- Require CVV on every authorization. A mismatch should decline or route to manual review, depending on your risk appetite.
- Never store the CVV. PCI DSS classifies the security code as sensitive authentication data, which must not be retained after authorization, even in encrypted form.
- Turn on 3-D Secure / EMV 3DS. Issuer-side authentication shifts liability and stops many stolen-card attempts before settlement.
- Combine AVS with CVV. Address verification plus code verification catches mismatched combinations that a code check alone misses.
- Apply velocity and geography rules. Multiple cards from one device, mismatched billing countries, and rapid repeat attempts are strong fraud signals.
- Tokenize stored credentials. Network tokens let returning customers check out without exposing a reusable card number and code.
- Review chargebacks weekly. Dispute patterns reveal which checkout paths are being targeted.
For shoppers: keeping your CVV out of a dump
- Use virtual or single-merchant card numbers where your issuer offers them.
- Never read card details aloud in public or send them by email, chat, or text.
- Type merchant addresses directly instead of following links from messages.
- Check statements often; a small test charge usually precedes larger ones.
- Freeze the card and request a new number immediately if anything looks wrong, since a reissue invalidates the old CVV.
If you encounter these listings
Do not engage, pay, or "test" anything. Report the marketplace or message to the FBI Internet Crime Complaint Center, file a report with the FTC, and notify the card issuer whose brand appears in the listing. Merchants who find their own checkout being probed should alert their acquirer and fraud team the same day.
The bottom line
CVV dumps for sale exist only because card data is valuable to criminals. The durable defense is not a better marketplace but better verification: mandatory CVV checks, no storage of security codes, issuer authentication, and fast detection of testing behavior on your own checkout.