What a CVV is
A CVV is a 3 digit code printed on the back of Visa, Mastercard and Discover cards. American Express prints a 4 digit CID on the front. The code is a check value. It is not encoded on the magnetic stripe or the EMV chip, so a copied stripe does not produce it.
Best CVV Shop to Sell in 2024: A Comprehensive Comparison Review
What CVV selling shops are
Carding sites list stolen card numbers with the code attached. Sellers describe the bundles as dumps or fullz. Buyers use them at merchants that ask for the code and skip other checks. The inventory is stolen card data. A purchase from one funds card theft and counts as fraud in the US under 18 U.S.C. 1029. This page does not rank those sites and does not link to them. The comparison below covers what a merchant or cardholder can put in place instead.
First pick: network tokenization
A network token replaces the 16 digit card number with a token issued by Visa or Mastercard. The token is bound to one merchant, one device or one channel. A stolen token does not work at another shop. Tokenized orders also drop the stored CVV, which PCI DSS bars you from keeping after authorization. Cost is a per token fee from the processor. Setup runs weeks, not months.
Option 2: EMV 3-D Secure
EMV 3DS adds an authentication step between the checkout page and the issuer. The issuer scores the session and can approve without a challenge. Fraud liability shifts to the issuer when authentication succeeds. Friction rises for some buyers. EMVCo owns the specification.
Best CVV Shop to Sell Cheap: A Comprehensive Buying Guide
Option 3: Virtual card numbers for cardholders
Several US issuers issue a single-use card number with its own CVV for each merchant. The number expires after one charge or a set date. A breach at the merchant exposes a dead number, not the real account.
Option 4: Address Verification and velocity limits
AVS compares the billing address against the issuer record. Velocity rules cap the count of orders per card, per IP and per shipping address in a fixed window. Both are cheap to add and catch low effort card testing.
What to ask any provider
- PCI DSS scope: does the provider keep card data out of your systems? PCI DSS Requirement 3.2 bars storage of the CVV after authorization.
- Token portability: does the token survive a change of processor?
- Dispute data: ask for the chargeback rate on card-not-present orders for the last two quarters.
- Key rotation and logging: who holds the keys, and how long are access logs kept?