A CVV is the 3-digit code printed on the back of most Visa, Mastercard, and Discover cards, or the 4-digit code on the front of an American Express card. It proves the person typing the card number has the physical card in hand. Card networks require it for online and phone orders, so a checkout page that asks for it is normal. A message, email, or listing that offers to sell CVV data is not.
Card data that belongs to someone else is not a product. Buying it or selling it is fraud, and in the US it falls under identity theft and access device laws. The rest of this guide covers how the code works, how to protect yours, and how stores should handle it.
What does a CVV code do?
The printed code is generated when the card is manufactured. It is separate from the data on the magnetic stripe, so a skimmer that copies the stripe does not get the printed code. That gap is the whole point: a stolen card number from a receipt or a database still fails most online orders without the code.
Banks use the code as one signal among several. A mismatch on the CVV usually pushes an order into review or declines it outright, even when the card number and expiration date are correct.
Selling CVV on a Shop with Bitcoin: A Comprehensive Guide
Why no legitimate store keeps your CVV
- The PCI DSS standard forbids storing the code after authorization, even in encrypted form.
- A store that keeps CVV data turns one breach into a ready-made card-cloning kit for attackers.
- Card brands can cut off a merchant's ability to accept cards for repeated violations.
That is why good checkouts pass the code to the payment processor and drop it. If a shop emails you a form asking for the code, or a support agent asks for it in chat, treat that as a fraud signal about the shop itself.
How to protect your CVV when you shop online
- Type the code only on the checkout page. Check that the address bar shows HTTPS and the domain matches the store before you enter anything.
- Never send it by email, text, chat, or social message. No real store needs the code outside its payment form.
- Ignore incoming calls that ask for it. Hang up and call the number on the back of your card if you want to check.
- Use a digital wallet or virtual card. Apple Pay, Google Pay, and PayPal pass a token, so the merchant never sees your real code.
- Cover the back of the card in public. A quick photo of the back is enough to use the card online.
What are the red flags of a fake shop?
- Prices far below market on items that are hard to find anywhere else.
- Checkout that asks for the CVV plus a photo of the card, or asks you to confirm the code over chat.
- No physical address, no return policy, no working phone number.
- A new domain with reviews that repeat the same phrasing.
- Payment accepted only by wire, gift card, or crypto.
Is it legal to ask for a CVV online?
Yes. A store can ask for the code at checkout, and most do. What it cannot do is store the code after the transaction, which PCI DSS requires and card networks enforce through merchant agreements. Selling card data, buying it, or using someone else's code is a crime in the US and most other countries.
How should a store handle CVV data?
- Capture the code in the payment field, send it to the processor, then drop it. Never write it into your order database, help desk notes, or confirmation emails.
- Use hosted payment fields or a tokenization service so the code never touches your servers.
- Turn on 3-D Secure for high-risk orders. It adds an issuer check at checkout.
- Compare address verification and CVV results, and flag mismatches for manual review.
- Train staff. An agent who asks a customer for a CVV in a chat opens a fraud channel.
Do wallets and virtual cards remove the risk?
They cut it. A token replaces your card number and code, so a breach at the store exposes nothing reusable. Your card still has a printed code, though, and any site that collects it directly still creates exposure.
Common questions
Can a thief use my card without the CVV?
Sometimes. Merchants that skip the code, and recurring charges set up earlier, can still go through. Report a lost or stolen card even if you think nobody saw the back.
Should I give my CVV over the phone?
Only if you placed the call to a number printed on your card or listed on the official site. An incoming call that asks for it is a scam.
What if a site asks me to verify my CVV with a photo?
Close the page. No legitimate checkout asks for an image of your card, and no legitimate seller offers card codes for sale.