What a CVV code is
The CVV is a 3 or 4 digit code. Visa, Mastercard, and Discover print 3 digits on the back signature panel. American Express prints 4 digits on the front, above the card number. The code proves the physical card is present. Card networks do not encode it on the magnetic stripe and do not print it on receipts.
What sites that advertise CVV sales offer
A search for cheap CVV data returns pages that claim to sell card numbers with the CVV attached. These pages are not banks, card issuers, or payment processors. Card data of that kind comes from breaches, skimmers, or merchant compromise. Sale of it is a federal crime in the US under 18 U.S.C. 1029, with comparable statutes elsewhere.
CVV Selling Website Buying Guide
Two outcomes are common. The seller takes payment and ships nothing. Or the seller ships card numbers that were canceled weeks earlier. The buyer cannot report the loss, because the purchase itself was illegal.
Why the price is low
Low prices act as a filter. Sellers use them to collect payment from buyers who do not test. A card with a working CVV and a live balance carries a price tied to its balance and its issuing region. A price far below that range points to test data, burned cards, or no product at all.
How cardholders protect the CVV
- Keep the card in sight during in-person transactions.
- Enter the CVV only on a page with a valid TLS certificate and a merchant you know.
- Request a virtual card number from the issuer for unfamiliar sites. Virtual numbers carry their own CVV and can be capped or closed on demand.
- Turn on transaction alerts. Issuers send a message for each charge above a set amount.
- Read statements each month. Small test charges often come before large ones.
How merchants handle CVV data
PCI DSS requirement 3.2 bans storage of sensitive authentication data after authorization. The CVV sits in that category. A merchant may pass it to the processor and must not write it to a database, a log file, or a receipt. A merchant that keeps CVV values raises the damage from any breach on its own systems.
If a card is used without permission
Call the issuer first. The issuer can reverse charges and reissue the card. Then file a report with the FTC and with the FBI Internet Crime Complaint Center. Those reports feed law enforcement cases, but they do not recover money on their own.