The short answer
There is no legitimate low-cost channel for selling CVV numbers. Buying or selling card verification values that belong to someone else is a federal crime in the United States and most other jurisdictions, and it is prosecuted as identity theft, access device fraud, or wire fraud. So this guide does not cover sourcing, pricing, or marketplaces. It covers the other side of the same question: how card-not-present fraud works, why stolen card data circulates at all, and what merchants, processors, and cardholders can put in place to shut it down.
If you run an online store, the practical takeaway is that a CVV check alone is not a fraud strategy. It is one signal among several, and it should sit on top of address verification, velocity limits, device intelligence, and 3D Secure authentication. If you are a shopper, the practical takeaway is that your card number, expiry, and CVV are worth guarding as a set, and that no legitimate merchant or bank will ask you to read them out over email, text, or chat.
Buying Guide: How to Buy Fresh CVV Cheap
How stolen card data actually moves
Understanding the flow matters, because each step has a matching control that can break it.
- Collection. Data is lifted from a breached merchant database, a skimmer on a physical terminal, a phishing page, or a support scam. Anywhere a full card number, expiry date, and CVV are stored together, that storage becomes a target.
- Consolidation. Stolen records get bundled and resold in bulk. This is where the volume comes from, and it is why per-record prices on criminal forums fall so far. Low price is a symptom of oversupply after a breach, not a shopping feature.
- Cash-out. Records are tested against real merchants using automated scripts, then converted into goods, gift cards, or digital currency before the issuer catches on.
- Chargeback. When the real cardholder notices, the transaction is disputed. The merchant absorbs the loss plus fees unless they can prove the transaction was legitimate.
What to look for in fraud controls
Evaluate any fraud stack against the points above rather than against a feature checklist.
Cheap CVV "Profit Margins": A CVC Security Buying Guide
- CVV verification. Confirms the three or four digit code matches what the issuer has on file. Strong signal, but it fails completely if your system stores the CVV after authorization, which PCI DSS prohibits.
- Address Verification Service. Compares billing street and postal code. Best used as a scoring input, not a hard accept or decline, because real customers mistype addresses.
- 3D Secure authentication. Shifts liability for qualifying transactions and forces a step-up challenge on risky orders. Adds friction, so apply it selectively.
- Velocity and device rules. Catch the automated testing patterns that fraud scripts produce: many cards from one device, many cards to one shipping address, rapid small orders.
- Manual review queue. Necessary for high-value or mismatched orders, but it only works if staff have clear escalation rules and response time targets.
Thresholds and settings that matter
Exact numbers depend on your acquirer, your vertical, and your volume, but these bands are a reasonable starting frame.
- Decline on CVV mismatch plus AVS mismatch. Treat the combination as a block, and treat either mismatch alone as a review trigger.
- Chargeback ratio. Card network monitoring programs commonly begin flagging merchants somewhere around 0.9 percent of transactions, with stricter tiers above roughly 1.5 to 1.8 percent. Stay well under the first number.
- Order velocity. Flag multiple attempts from one device or IP within a short window, even when each attempt is below your per-order review threshold.
- Order value. Set your manual review floor based on your average order value, not a round number pulled from a template.
Pitfalls to avoid
- Storing CVV values anywhere after authorization. This violates PCI DSS and turns one breach into a catastrophic one.
- Relying on a single signal. Fraudsters adapt to any check that runs alone.
- Blocking every AVS mismatch. You will decline legitimate customers and lose more revenue than fraud costs.
- Ignoring friendly fraud. A large share of disputes come from customers who authorized the purchase and later contested it.
- Treating a cheap bulk data offer as a business opportunity. It is evidence of a crime, and possession alone carries exposure.
FAQ
Is selling CVV data ever legal?
No. Card verification values belong to the issuing bank and the cardholder. Transferring them without authorization is access device fraud in the US and a comparable offense nearly everywhere else.
Why does stolen card data get sold so cheaply?
Because breaches produce it in bulk and the useful lifespan of a record is short. Sellers dump inventory before issuers cancel the cards, which pushes prices toward zero.
What should I do if my card details were exposed?
Contact your issuer immediately, request a replacement card with a new number, review recent statements line by line, and file a report with the FTC and your local police if money was taken.
Does a CVV check guarantee a transaction is safe?
No. It confirms the code matches the issuer record at that moment. It says nothing about whether the person entering it is the cardholder.