A CVV shop is a marketplace that sells stolen payment card data. Buyers get card numbers, expiration dates, names, and sometimes the three-digit security code. Using that data to buy goods is carding. In the United States it violates 18 U.S.C. § 1029, which covers fraud and related activity in connection with access devices. No legal path exists to start. The useful beginner step is the opposite one: learn how card data gets stolen and how to keep your own card out of those lists.
What CVV and CVC Mean on a Real Card
CVV stands for card verification value. Visa uses the term CVV2. Mastercard uses CVC2. American Express prints a four-digit code on the front. The code sits next to the signature strip or above the card number.
Card networks built the code for card-not-present orders. A merchant asks for it to check that the buyer holds the physical card. The code is not the same as the PIN. It does not authorize a transaction on its own.
What a CVV Shop Sells
Sellers list records pulled from breaches, skimmers, and phishing pages. A record usually holds the card number, expiry date, cardholder name, and the security code. Some records add a billing address or a phone number.
Prices change with demand and with the card's credit limit. Public price lists exist, but figures vary by source and are not reliable. The FBI tracks these markets and treats them as criminal operations.
Two facts about the shops matter more than price. First, the goods are stolen property. Second, the seller has no reason to deliver. Buyers who pay get a file that may be expired, already used, or invented. There is no refund, no dispute process, and no support channel.
Why Carding Leads to Prosecution
18 U.S.C. § 1029 sets prison terms for producing, selling, or using access devices without authorization. Sentences reach 10 years for basic offenses and 15 years for offenses tied to specific aggravating conduct. Federal prosecutors charge buyers along with sellers. The Department of Justice and the FBI publish indictments that name individuals who bought card data in small volumes.
The trail follows the money. Payment processors, shipping addresses, and IP logs give investigators a route back to the buyer. A single order can supply all three.
How Card Data Leaves a Cardholder's Hands
- Skimming devices placed on gas pumps, ATMs, and self-checkout lanes.
- Phishing emails and text messages that copy a bank or a delivery company.
- Fake checkout pages on lookalike shopping sites.
- Malware on a home computer that reads data typed into a browser.
- Merchant breaches that expose stored records.
PCI DSS forbids keeping the CVV after a transaction authorizes. It is sensitive authentication data. Merchants that store it break the standard and create the raw material that shops resell.
Steps That Protect a Real Card
- Turn on transaction alerts in the card issuer's app. Alerts arrive in seconds and show the merchant name.
- Use virtual card numbers for online orders. Several US issuers generate a single-use number tied to one merchant.
- Check the statement each month against receipts. Small test charges come before large ones.
- Freeze the card in the app when it is not in use.
- Pay with a chip or a tap at terminals. Avoid swiping a magnetic stripe.
- Type card details only on sites with a full street address and a working phone number.
If a Card Number Is Used Without Permission
Call the issuer first. Federal rules limit a cardholder's liability for unauthorized charges, and the issuer cancels the number. Then file a report at IdentityTheft.gov, which the FTC runs. Add a report to the FBI's Internet Crime Complaint Center at ic3.gov. Keep the written confirmation from each filing.
Questions Beginners Ask
Does a CVV shop offer buyer protection? No. The transaction is a crime, so no court or platform will enforce it.
Is testing a stolen card a crime? Yes. An authorization attempt counts as use of an access device.
Can a cardholder consent to a sale of their own data? No. Card networks and issuers own the payment credentials, and the terms of every cardholder agreement bar transfer.