The three or four digit code on a payment card is a fraud control, not a product. It exists so that a merchant can confirm the person entering a card number actually holds the physical card. Requests for places to buy or sell CVV data describe card trafficking, which is a criminal offense in the United States and most other countries. This guide covers the legitimate side of the topic: how the code works, how to protect it, and what to do when it leaks.
Why CVV data gets targeted
Card numbers and expiration dates are stored in many places, so a breach of a retailer or processor can expose them in bulk. The CVV is different. Payment card industry rules bar merchants from storing the code after a transaction is authorized. That makes the CVV the piece attackers most often have to obtain separately, usually through phishing pages, skimmers, or malware on a checkout page. Because it is harder to get, it carries a premium in underground markets and is heavily used in card-not-present fraud.
If you are a cardholder
- Treat the code like a password. Never read it aloud in a public place, photograph it, or send it in a chat or email.
- Enter card details only on checkout pages you reached by typing the merchant domain yourself or by using a saved bookmark.
- Check that the address bar shows HTTPS and that the domain matches the brand, character for character.
- Decline requests from anyone who calls, texts, or emails asking you to confirm the code to "verify" or "unlock" an account. Banks do not ask for it.
- Use a virtual card number from your issuer for subscriptions and unfamiliar sites so the real number and code stay private.
- Review statements weekly and turn on transaction alerts for every charge.
If you run an online store
- Collect the CVV at checkout and pass it straight to your processor.
- Confirm your gateway is configured to discard it after authorization.
- Audit logs, databases, and support tickets for any stored code, and delete what you find.
- Require 3-D Secure or an equivalent step-up check on high-risk orders.
- Keep checkout scripts, plugins, and payment libraries patched, and monitor for injected code that copies form fields.
If your card data is exposed
- Call the number on the back of your card and ask for the card to be closed and reissued.
- Change the password on the merchant account where the breach happened, and anywhere you reused it.
- File a report at IdentityTheft.gov and keep the confirmation.
- Dispute unauthorized charges in writing within the window your issuer allows.
- Report the incident to the FBI Internet Crime Complaint Center if money was taken.
Buying and selling CVV data
There is no legitimate marketplace, no safe vendor, and no buyer protection for stolen payment credentials. Sellers routinely resell the same data, buyers get scammed, and both sides face felony charges under identity theft and access device statutes. No guidance on locating, pricing, or trading that data appears here.