Start with the card, not the seller
The CVV is the 3-digit code on the back of a Visa, Mastercard, or Discover card. American Express prints 4 digits on the front. The code proves the physical card is in hand during a card-not-present transaction. No payment network licenses CVV numbers for resale. Any site that offers to sell you one is offering stolen card data.
PCI DSS forbids a merchant from storing the CVV after an authorization, even in encrypted form. A seller who claims to hold bulk "fresh" CVVs is describing data taken from a breach or a skimmer. Buying it is a federal offense in the US under 18 U.S.C. § 1029.
Protecting your own code at checkout
- Type the CVV into the payment form. Never send it by email, text, or chat. A support agent who asks for the full code by phone is out of policy.
- Read the address bar before you type. The checkout page should sit on the merchant's own domain over TLS.
- Open the issuer app and turn on card controls. Most US banks let you lock the card, set spend caps, or block online charges.
- Use a virtual card number when the issuer offers one. The number maps to your account and expires after one merchant or one set of charges.
- Keep the card face covered. A photo of the front and back is all a thief needs.
Parameters to check before you pay
- Merchant name and statement descriptor, so the charge matches later.
- Return window and cancellation terms.
- Whether the site stores your card for future orders, and how to delete it.
- Refund method and timeline.
Pitfalls
- "CVV generator" tools and checker scripts. Output is random digits or records from prior breaches.
- Forums and chat channels that price cards by BIN. The listings are fraud, the escrow is fake, and the buyer becomes the target.
- Sellers who want payment in gift cards or crypto. No recourse exists.
- Card photos posted in group chats. That data is burned, meaning the issuer has most probably canceled the card.
If your code is exposed
Call the issuer and ask for a replacement card with a new number. Dispute unauthorized charges within 60 days to keep Reg E or FCRA protections. File a report with the FTC and with the FBI Internet Crime Complaint Center.