Start with the rule that settles the question
You cannot buy or sell CVV data in any lawful market. Sites that market themselves as carding shops, CVV vendors, or "card buyers" trade in stolen payment credentials, and dealing with them carries criminal exposure, malware risk, and direct loss of your own money. The purchase decision that actually belongs to you is the reverse one: which merchant can be trusted with the CVV printed on your card. Choose sellers that never keep the three or four digit code after the transaction is authorized, that host the card entry field on their payment processor's side of the checkout, and that support an extra verification step such as 3-D Secure. If a store cannot explain how it handles card data in plain terms, buy somewhere else.
What to check before you type a card number
- Payment page ownership. The card fields should sit inside an iframe or hosted form from the processor, not inside the merchant's own page. That keeps the code off the merchant's servers.
- Stated PCI DSS compliance. Look for a current attestation of compliance or a self-assessment questionnaire published on the site. Large merchants should hold Level 1, small ones may sit at Level 4, but every merchant must validate something.
- Transport security. The address bar should show a secure connection, and the certificate should match the domain. TLS 1.2 is the floor; TLS 1.3 is the better target.
- Authentication options. 3-D Secure version 2 or an equivalent risk-based challenge adds a check that a stolen number alone will not pass.
- Dispute terms. Clear refund windows, chargeback handling, and a support channel that does not ask you to email your card details.
Parameter bands worth comparing
- Card data retention: ideal is zero CVV retention after authorization; acceptable is nothing stored at all beyond a network token. Any policy that mentions storing CVV2 for future charges is outside card network rules.
- Tokenization: look for network tokens or processor tokens with a fixed scope, so a breach at the merchant yields no reusable card number.
- Authentication depth: frictionless 3-D Secure for low risk orders, step-up challenge for high risk ones. A fixed challenge for every order costs conversions, a fixed frictionless flow costs fraud control.
- Refund and cancellation window: 14 to 30 days is common for physical goods, shorter for digital. Anything under seven days on a physical product deserves a second look.
- Chargeback support: a written process with response times measured in days, not a promise that disputes will be "handled internally."
Pitfalls that point to fraud or carelessness
- Any site that offers to buy, sell, trade, or "check" card numbers. Card checkers and CVV markets exist to move stolen data, and they are used to test cards before resale.
- Requests to send a card number, expiry, and CVV by email, chat, or text message. No legitimate seller needs that.
- Prices far below market on high demand goods, paired with pressure to pay by gift card, wire, or cryptocurrency.
- Checkouts with no visible processor branding, no address verification, and no card verification step.
- Marketplace sellers who ask you to complete payment off platform.
- Pop-ups or downloads on the payment page. Skimmers hide in injected scripts, so a busy or unfamiliar checkout is a reason to stop.
Frequently asked questions
Is it legal to sell CVV data?
No. Selling or buying card verification values that belong to someone else is fraud in the United States and most other jurisdictions. This guide covers only how to protect the code on your own card.
how to sell cvv on carding forums
Can a merchant store my CVV for later charges?
Card network rules bar merchants from keeping the CVV after a transaction is authorized, even with encryption. Recurring billing runs on a token or on the account number and expiry, never on the code.
how to sell cvv on carding forums
Why did my bank ask for a one time code at checkout?
That is the 3-D Secure challenge. The merchant or the issuer flagged the order as higher risk and requested proof that you hold the card.
What should I do if a site asks for my CVV over email?
Decline, cancel the order, and contact your card issuer if you already sent the details. Then report the incident to the relevant consumer protection authority.
Does a padlock icon prove the checkout is safe?
No. It only shows that the connection is encrypted. It says nothing about who is on the other end or whether the site keeps your card data.