What a CVV is
A CVV is a 3-digit code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The issuer generates the code from the card number and a secret key, so a merchant can check that the person typing the number also holds the physical card.
Card networks call this verification method CVV2, CVC2, or CID, based on the brand. The check applies to card-not-present orders: online, phone, and mail.
Federal law on card data
18 U.S.C. Section 1029 covers fraud and related activity in connection with access devices. Account numbers, CVVs, and login credentials fall under that definition. Buying, selling, or transferring them without authorization is a federal offense. A first offense carries up to 10 years in prison; a second carries up to 20 years. Fines reach $250,000 for an individual.
Prosecutions are not theoretical. The Department of Justice charges carding operations every year, and the FBI Internet Crime Complaint Center tracks the losses.
Why 'cheap CVV, Bitcoin accepted' listings exist
Sellers of card data fall into two groups.
- Operators who hold data from breaches, skimmers, or phishing, and move it before banks block the accounts.
- Operators who sell invented numbers. The buyer pays Bitcoin, receives nothing usable, and has no recourse. Bitcoin transfers are final.
Both groups expose the buyer. Card data bought from a stranger cannot be verified before purchase. Payment in Bitcoin removes chargeback rights and links the transaction to a wallet ledger that investigators can subpoena from exchanges.
This article does not list or endorse any marketplace. The activity described is illegal in the United States and in most countries.
How card-not-present fraud gets detected
- CVV mismatch on the authorization request.
- Address Verification System mismatch on the billing address.
- Card testing: many small orders in a short window from one IP range.
- Velocity rules across device, email, and shipping address.
- Issuer alerts and network fraud scoring.
What merchants must not do
PCI DSS Requirement 3.2 prohibits storage of sensitive authentication data after authorization. That data includes the CVV, the full magnetic stripe contents, and the PIN block. Storing a CVV after a transaction is a violation, with or without encryption. Tokenization and payment processor vaults exist so merchants never touch the raw code.
Steps for cardholders
- Check the account statement each month for charges you did not make.
- Use a virtual card number for subscriptions and one-off sites.
- Report a lost card or a suspected breach to the issuer on the number printed on the card.
- File a report at IdentityTheft.gov and keep the reference number.
Unknown: exact annual losses from card-not-present fraud vary by source and year. The FBI and the FTC publish figures that do not always align.