Card verification values are not a retail product
No marketplace sells card verification values the way a store sells goods. A CVV is the three digits on the back of a Visa, Mastercard, or Discover card, and four digits on the front of an American Express card. The issuer generates it and ties it to one account. Sites that advertise CVV inventory sell text files, screen captures, or generated numbers. The buyer cannot confirm an account is open, funded, or unused before paying.
which dark web site sells cvv fullz
Buying or using that data is carding. In the United States, 18 U.S.C. 1029 covers trafficking in and use of unauthorized access devices. A first offense carries up to 10 years in prison. Aggravated cases carry up to 15 years. 18 U.S.C. 1028A adds a mandatory two-year consecutive term when the card data belongs to another person.
Cardholders and merchants have legal options that reduce card-not-present fraud. The four below are ranked by measured effect.
1. Network tokenization (the pick)
Network tokenization replaces the 16-digit account number with a token issued by the card network. EMVCo publishes the specification the networks use. The CVV is not stored with the token. A stolen token fails at any other merchant. Tokenized card-on-file transactions carry lower fraud rates than transactions that pass a raw account number, which is why Visa, Mastercard, and American Express push the standard for subscriptions and stored cards.
2. 3-D Secure 2.x
3-D Secure adds an authentication step between checkout and authorization. The issuer reads device, IP, and account history, then approves the charge without a prompt or asks for a code in the bank app. Version 2 moved most traffic to the silent path, so friction dropped. Liability for fraud shifts to the issuer when authentication succeeds.
3. Virtual card numbers
Issuers and fintechs issue card numbers locked to one merchant or one transaction, with a spend cap and an expiry the user sets. A leaked number fails outside its assigned use.
4. PCI DSS-compliant vaults
PCI DSS prohibits storing the CVV after authorization. Merchants that keep cards for repeat purchases store the account number in a vault and re-request the CVV or rely on 3-D Secure. Requirement 3 of PCI DSS v4.0 governs this.
Checks before typing a CVV
- TLS on the checkout page, with a lock icon and a valid certificate.
- A published PCI DSS attestation, or a processor that handles the card fields.
- A 3-D Secure prompt from the issuer app or a bank SMS code.
- No email, chat, or phone request for the CVV. Legitimate sellers do not ask.
Bottom line
Hidden forums that list CVV data are fraud channels, and the data on them is reused, expired, or fabricated. The safe path is the same for shoppers and merchants: tokenize, authenticate with 3-D Secure, and use single-use numbers where the issuer offers them.