The CVV is the 3 or 4 digit code printed on a payment card, and it exists to prove the card is in the buyer's hands at checkout. There is no legal way to buy CVV numbers from anyone, and sites that advertise them are either moving stolen card data or taking money for nothing. The code belongs to the cardholder and stays with the card.
What is a CVV code?
A card verification value is a short number printed on the plastic but not encoded on the magnetic stripe or the chip. It acts as a second check on card-not-present orders, where no terminal reads the card. Banks call it CVV2, CVC2, or card identification number depending on the network.
Where the code sits on each card
- Visa, Mastercard, Discover: 3 digits on the back, to the right of the signature strip.
- American Express: 4 digits on the front, above the card number on the right side.
- Virtual and tokenized cards: a separate code issued by the bank, often refreshed for each merchant.
The printed code changes only when the card is reissued. That is why a leak of the number plus expiry and card number is enough to attempt a purchase.
Can you buy CVV numbers online?
No. US law treats card numbers and their verification codes as access devices under 18 U.S.C. § 1029, which covers the sale and possession of stolen account data. A buyer who runs a stolen code commits fraud even when the charge clears, and the merchant's chargeback lands on the cardholder's bank, not the seller.
Markets that post "fresh CVVs" or "fullz" follow a pattern. The seller takes crypto, delivers numbers that fail or were already reported, then keeps the buyer's contact details for extortion. Some listings are pure fiction built to harvest payment from people who cannot complain to anyone.
If a stranger asks you to buy, sell, or "test" a card verification code, treat the message as a scam. The same applies to anyone who offers a cut of a purchase in exchange for using your card details.
Why online stores ask for the CVV
The code raises the cost of an attack. A thief with a card number from a data breach still needs the physical card, or a photo of it, to finish the order. That gap is the whole point of the check.
PCI DSS Requirement 3.2 forbids merchants from storing the CVV after authorization, even in encrypted form. A checkout page that offers to save the code for next time is breaking the standard, and a support agent who asks you to read it out is creating a record that should not exist.
Many banks add a 3-D Secure prompt at checkout as a second layer. The prompt moves the code entry to the issuer's page, so the merchant never sees the digits.
How to protect your own code
- Type the CVV only on a page served over HTTPS, and only after you confirmed the domain.
- Never send the code by email, chat, or text, and never photograph the back of a card.
- Use a virtual card from your bank for subscriptions and unfamiliar stores. A leaked virtual code is replaceable in minutes.
- Cover the printed code with a small sticker if you carry the card in a bag or a pocket.
- Decline "save my card" offers on shared devices, and clear browser autofill on a laptop others use.
How to check a checkout page before you type the code
- Address bar: the padlock and the full domain. Look for the store's own name, not a lookalike with an extra word or hyphen.
- Form fields: a real store asks for the 3 or 4 digits and nothing else. Requests for a PIN, a full password, or a screenshot of the card are fraud.
- Contact route: a phone number or a support address on the site itself. Sellers who move the deal to chat apps avoid refunds and records.
- Payment method: card entry on the store's own checkout, or a redirect to the bank's verification page. Both are normal. A request to send funds by gift card or crypto is not.
Pitfalls that catch cardholders
- Phone orders. A caller who claims to be from the bank or the store and asks for the code is running a scam. Real staff never need it.
- Saved codes in notes apps. A single phone backup copies them to a cloud account.
- Public Wi-Fi at checkout. Unencrypted networks let an attacker watch the session, code included.
- Small test charges. Fraudsters run a $1 order first. A card you do not recognize on your statement deserves a call that day.
Frequently asked questions
Is it safe to give my CVV over the phone?
No. Legitimate stores take the code on their own secure checkout, and banks never ask for it. A caller who wants the digits is after your money.
Do virtual cards have a CVV?
Yes, and it works the same way at checkout. The difference is that the number, expiry, and code are tied to one merchant or one spending limit, so a leak costs little.
What happens if my CVV is exposed?
Call the issuer and ask for a replacement card. The code cannot be changed on its own. Freeze the card in the bank app first if the app offers it, then watch the next two statements for small test charges.
Can a merchant keep my CVV on file?
Not under PCI DSS. Stores keep a token from the payment processor instead, which authorizes repeat charges without the code. If a site shows your saved CVV on screen, that store is storing data it should not hold.