Top pick: issuer-issued virtual card numbers. I ranked the options below on three criteria: whether a stolen CVV stops working once the defense is active, how much control the cardholder keeps, and how widely the method works at US online merchants without a workaround. Virtual card numbers win because they replace the number you type into a checkout form and can be locked to a single merchant with a spending cap.
One note before the comparison. I will not rank marketplaces that trade fullz or CVV dumps. Buying, selling, or using stolen card records is card fraud under US law, including 18 U.S.C. Section 1029, and a review of those sites would amount to instructions for committing it. The rest of this page compares the legitimate controls that make a leaked CVV worthless, which is the practical outcome behind that search.
1. Virtual card numbers from your bank or issuer
Your issuer generates a substitute card number, expiration date, and CVV that map back to your real account. Most issuers let you set a spending limit, an expiration window, or a single-merchant lock.
Pros
- If the merchant is breached, the number you handed over is the one that leaks, not your real card.
- You can close a virtual number without replacing the physical card or updating every other saved payment method.
- Per-merchant numbers make it obvious which site leaked or sold your data.
Cons
- Availability varies. Some US issuers limit virtual numbers to certain card tiers or business accounts.
- Free trials and recurring subscriptions can break when a number rotates or hits its cap.
- A few merchants decline card numbers they cannot match to a billing address.
Use it if: you check out on unfamiliar sites, small shops, or anywhere you enter card details by hand.
2. Network tokenization through a wallet
Tokenization, specified by EMVCo, swaps your primary account number for a token bound to one device or one merchant. Apple Pay, Google Pay, and merchant-side vaults all use this model.
Pros
- No CVV is typed at checkout, so there is nothing for a keylogger or a skimmer page to capture.
- A token stolen from one merchant generally cannot be replayed at another.
- Widely supported at large US retailers and delivery apps.
Cons
- Requires a phone or a browser that supports the wallet, which rules out some desktop checkouts.
- An unlocked device with the wallet open is still a risk if it is lost or stolen.
- Small merchants sometimes do not accept wallet checkout at all.
Use it if: you want a default checkout method with the least data entry.
3. Step-up authentication (3-D Secure and bank approvals)
3-D Secure asks your bank to approve a transaction during checkout, usually through an app prompt or a one-time code.
Pros
- Blocks automated card-testing runs that try thousands of stolen numbers in minutes.
- Shifts fraud liability toward the bank when the merchant participates.
- Common on European merchants and growing among US issuers.
Cons
- Adds friction and can fail on travel or with a weak signal.
- SMS codes are phishable and vulnerable to SIM swap attacks.
- Not all merchants enable it, so coverage is uneven.
Use it if: your bank offers in-app approval. Prefer that over a texted code.
4. Card controls and transaction alerts
Pros
- Freeze the card from an app the moment something looks wrong.
- Alerts on card-not-present charges surface a leak early.
- Many apps allow category or geographic blocks.
Cons
- Reactive. The first fraudulent charge already went through.
- Controls differ a lot between issuers and can be buried in settings.
Use it if: you want fast detection on top of one of the methods above, not instead of them.
5. A separate low-limit card for online use
Pros
- Caps the damage from any single breach.
- Keeps your main account statement clean and easy to audit.
Cons
- Another account to monitor and pay.
- Does nothing to stop the leak itself.
Use it if: you buy from many small vendors and want a hard ceiling on exposure.
How to choose
- Turn on wallet payments for everyday checkouts.
- Use issuer virtual numbers anywhere you must type a card.
- Enable in-app transaction approval and instant alerts.
- Report fraud to your issuer, then file at the FTC and IC3 so the pattern gets recorded.
None of these methods require you to trust the merchant with your real CVV, and that is the point. A checkout that never exposes the real number cannot leak it.