What a CVV is
A card verification value is a short code printed on a payment card. Visa, Mastercard and Discover print three digits on the back. American Express prints four digits on the front. The code proves the person entering the card number holds the physical card. Card networks label it CVV2, CVC2 or CID by brand.
CVV Vendors on Dark Web List: A Comprehensive Guide
PCI DSS Requirement 3.2 forbids merchants from storing the code after an authorization. That rule explains the value of the code to a thief. It is the one field a merchant data breach does not hand over.
What "CVV for sale" listings contain
Search results with that phrase lead to carding markets. A seller posts a card number, an expiry date, a cardholder name and the three digit code. Listed prices run from a few cents to about $30 for a card with a high balance. Some sellers add bank login data, a billing address or a Social Security number.
Can I Buy a CVV on the Dark Web With Bitcoin? The Answer Is No
These listings are criminal records. The data comes from skimmers, phishing pages, merchant breaches and card testing runs. Buyers seldom receive a working card. Market operators take payment in crypto and close the site, and some markets run exit scams on purpose.
where to purchase cvv on dark web
Legal exposure in the United States
Buying or selling a payment card number falls under 18 U.S.C. 1029, the access device statute. A card number with a CVV qualifies as an access device. A first offense carries up to 10 years for a small number of cards and up to 15 years for conduct that affects more accounts. Civil liability follows the same conduct. The UK and EU prosecute the same acts as fraud under the Computer Misuse Act and national fraud statutes.
Steps if your card data appears in a listing
- Call the card issuer. Ask for a block on the current number and a replacement card.
- Change the password on the card account and turn on two factor authentication.
- Pull a credit report from AnnualCreditReport.com and look for accounts you did not open.
- File a report at IdentityTheft.gov and keep the reference number.
- Read the statement for test charges of $3 or less.
Pitfalls to watch for
- Sellers use the words "live" and "fresh" to signal a recent breach. No buyer can check that claim before payment.
- Escrow on a carding market offers no protection. The operator controls the escrow account.
- Card testing starts with small charges. A charge between $0.50 and $2 is the warning sign.
- Gift card and crypto payment methods leave no chargeback path.
- Offers of a "CVV checker" or "BIN lookup" on social media are phishing pages built to harvest a login.
Controls for merchants
Require the CVV on every card not present transaction. Never store it. Run an address verification check against the billing address. Rate limit failed authorization attempts per IP address and per card BIN. A rule that blocks more than five failures in one hour stops most card testing. Review orders where the billing address and the shipping address sit in different countries.
What to tell a cardholder
The code is not a password. It changes with each new card and it belongs on the card. No bank, no processor and no merchant needs the code by phone, by email or in a chat message. A request for the full number plus the code outside a checkout page is fraud in progress.