What is a CVV or CVC code?
The CVV is the 3-digit code printed on the back of most Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The code exists to prove that whoever is typing the card number physically holds the card, which is the main fraud check in card-not-present transactions.
What are CVV shops, and why should you avoid them?
A CVV shop is a criminal marketplace that sells stolen card numbers and verification codes. Buying from one is card fraud under US law and carries real prison exposure, not just a chargeback. The cheap prices advertised in these venues are bait: the data is often already reported stolen, resold to several buyers, or used to extort the purchaser.
How do legitimate card networks handle CVV data?
PCI DSS rules bar merchants and processors from storing sensitive authentication data, including the CVV, once a transaction is authorized. That is why a real checkout page asks for the code every time instead of saving it. Any site that offers to store your CVV for faster checkout is a red flag.
CVV Shop Starter Guide: Safe Purchases and Card Security
How do you protect your CVV when shopping online?
- Type the code only on an HTTPS checkout page at a domain you trust.
- Never send a CVV by text, email, or chat, even to someone claiming to be your bank.
- Use a virtual card number or single-use number for unfamiliar merchants.
- Turn on transaction alerts and review statements each week.
- Cover the back of the physical card in public so cameras cannot capture the code.
What are legitimate low-cost options for online shopping?
Prepaid cards, bank-issued virtual card numbers, and secured credit cards give you a working card with a small spending limit. Most US issuers generate a one-time number inside their mobile app for a specific merchant, which keeps your main account number out of a breach. These options cost little or nothing and carry full fraud protection.
What are the warning signs of a carding scam?
- Sellers advertise card data in bulk with guarantees or refund policies.
- Payment is requested in gift cards, crypto, or peer-to-peer apps with no buyer protection.
- Access moves through invite links, Telegram channels, or mirror domains that change often.
- Pressure to buy fresh or high-balance data within minutes.
What should you do if your card data is stolen?
Contact your card issuer right away so the charge can be reversed and the card reissued. File a report with the FTC at ReportFraud.ftc.gov to help law enforcement connect the pattern to other cases. Change passwords on any account that stored the card and turn on two-factor authentication.
Is it legal to buy CVV numbers?
No. Purchasing stolen card data is fraud and can also bring charges for identity theft and unauthorized access. The only legal paths to a card you can use online are ones issued to you by a bank, credit union, or licensed prepaid provider.