There is no legal way to buy CVV codes for carding. Buying, selling, or using another person's card verification value is access device fraud under 18 U.S.C. § 1029, and federal charges carry prison terms of 10 years or more per count. What follows covers the legitimate side of the same subject: how CVV checks work at checkout, how carding rings operate, and how shoppers and merchants block them.
What a CVV code is and what it proves
The CVV is the 3-digit code printed on the signature panel of Visa, Mastercard, and Discover cards, and the 4-digit code on the front of American Express cards. Its job is to prove that whoever is typing the number has the physical card in hand. Card networks and issuers keep CVV data out of stored databases, so a leaked card number alone often fails at checkout.
CVV, CVV2, CVC, and CID: same idea, different names
- CVV2 / CVC2: the 3-digit code on the back of most cards.
- CID: the 4-digit code on the front of American Express cards.
- Magnetic-stripe CVV: encoded data on the stripe, readable only by a card reader, printed nowhere.
How carding rings work
Carding is the use of stolen card data to buy goods or move money. The data comes from breaches, skimmer devices on gas pumps and ATMs, phishing pages, and fake storefronts. A stolen record with name, address, card number, expiry, and CVV sells for a few dollars on the black market, then gets tested with small purchases before a larger theft.
Those test charges are what fraud teams watch for. A card that works for a $2 coffee at 3 a.m. in another country often fails within the hour.
What happens if you buy or sell CVV data
US federal law treats card data as an access device, and trafficking in it is a crime whether or not the card gets used. Penalties stack across federal and state courts.
- 18 U.S.C. § 1029: up to 10 years for a first offense involving a single device, and longer terms for repeat or large-scale operations.
- State identity theft and larceny charges can add more time on top.
- Merchants hit by chargebacks can sue for the goods plus fees.
- Buyers on carding forums get scammed at high rates. Fake shops take crypto and deliver nothing, and the buyer has no recourse.
How merchants verify CVV and stop carding
A CVV check is one layer. Card-not-present fraud control comes from stacking several checks, because each one alone can be beaten.
- Require the CVV on every e-commerce order. Skipping it raises fraud losses more than it raises conversion.
- Address Verification Service (AVS): compares the billing address and ZIP code to issuer records.
- 3-D Secure (EMV 3DS): pushes the cardholder into an authentication step with the bank. Authenticated transactions shift chargeback liability to the issuer.
- Tokenization: replaces the card number with a token, so the real account number never sits in your database.
- Velocity and device checks: flag many cards coming from one IP, one device, or one shipping address.
- Never store the CVV after authorization. PCI DSS forbids it. Requirement 3.2 lists the CVV and CVC as sensitive authentication data that must not be retained.
How shoppers protect their CVV
- Type card details only on sites with HTTPS and a recognizable payment processor at checkout.
- Use a virtual card number from your bank or a digital wallet such as Apple Pay or Google Pay, so the merchant never sees your real CVV.
- Freeze the card in your bank app when you are not shopping.
- Check statements each week. Small test charges are the first sign of carding.
- Report fraud to your issuer and file a report at IdentityTheft.gov.
Red flags of a "CVV seller" listing
Listings that promise bulk card data, "fresh" dumps, or guaranteed approvals are fraud operations. The people running them are committing a felony, and their buyers lose money on top of the legal exposure.
- Payment in crypto only, with no dispute path.
- Prices far below the going rate for real card data, or "refund" offers for dead cards.
- Contact through Telegram, Discord, or a Tor-only shop.
- Claims of "no chargeback" or "verified live" cards. Card issuers, not sellers, decide what authorizes.
FAQ
Is it illegal to buy a CVV code?
Yes. Buying card data that belongs to someone else is federal access device fraud in the US, and it is a crime in the UK, EU, Canada, and most other countries. No licensed marketplace sells CVV data.
Can a stolen CVV be used without the physical card?
Often, yes, for online orders where only the number gets checked. That is exactly why 3-D Secure and tokenized wallets exist.
What is the safest way to pay online?
Use a digital wallet or a virtual card number, keep the physical card frozen when you are not shopping, and turn on transaction alerts.
Does requiring a CVV stop all carding?
No. CVV checks block some stolen-number attacks, but fraud teams pair them with AVS, 3-D Secure, and velocity rules to catch the rest.