What the "cheap CVV with bitcoin" offers actually are
A card verification value is generated by the issuing bank and printed on the cardholder's card. It is not a product, and nobody can resell it. Listings that promise CVVs for a few dollars in bitcoin are one of two things: an advance-fee scam aimed at the buyer, or the sale of stolen payment data, which is a federal offense in the United States under 18 U.S.C. § 1029. In both cases the bitcoin leaves your wallet first, and the "vendor" keeps it. The practical question worth answering is the reverse one: how do you keep your own CVV/CVC out of other people's hands when you check out online.
Prerequisites
- A card with a separate CVC printed on the back, and the ability to freeze or lock it from your banking app.
- A password manager so each store gets a unique password.
- Order confirmations and receipts saved for at least one billing cycle.
How to vet a checkout page before you type your CVC
- Confirm the URL bar shows the store's real domain and a padlock, not a lookalike spelling.
- Open the site's privacy and returns pages and check they name a real business address.
- Look for a card-network or PCI compliance mark near the payment form.
- Check whether the payment fields are embedded from a known processor or sit directly on the store's page.
- Read the total, including shipping and currency, before entering card data.
- Enter your card number, expiry and CVC only on that form, never in a chat window or an emailed form.
- Save the order number and screenshot the confirmation page.
- Check your card statement within three days and dispute anything unfamiliar.
Parameters that decide the risk
Three things separate a routine purchase from a risky one. First, the merchant type: a store you have ordered from before carries far less risk than one reached through a social media ad or a direct message. Second, the payment rail: a credit card gives you chargeback rights that a peer-to-peer crypto transfer does not, and no legitimate retailer requires bitcoin for a card verification value. Third, the data footprint: a merchant that keeps your CVC on file after authorization is out of step with PCI DSS, which forbids storing the value post-authorization.
Pitfalls
- Being moved off-site to "confirm" a card in a chat app. Break off the order.
- Sellers who ask for the CVC alone, or a photo of the card. No legitimate merchant does this.
- Discount offers that arrive by text or direct message with a shortened checkout address.
- Entering a CVC on a page that reloads into a different domain during checkout.
- Reusing the card and password across stores, which turns one leak into many.
If a card detail does leak, freeze the card in your banking app, request a replacement number, and report the loss to your issuer the same day. In the US you can also file the incident with the FBI's Internet Crime Complaint Center.