A CVV shop for carding is an illegal online marketplace that sells stolen card numbers, expiration dates, and security codes. Buying, selling, or using that data is carding, and in the United States it is prosecuted as access device fraud under 18 U.S.C. § 1029, with penalties that can reach 10 years or more in prison. No CVV shop is legitimate, and the overwhelming majority of them are also scams that take the buyer's money.
What does "CVV shop for carding" actually mean?
CVV stands for card verification value, the 3 or 4 digit security code printed on a card or generated for digital wallets. Carding is the practice of using stolen payment credentials to buy goods, gift cards, or crypto before the real owner notices. A CVV shop simply packages those two ideas: it advertises stolen card data as a product with prices, "freshness" ratings, and bulk discounts.
Why is buying or selling CVV data illegal?
Federal law treats a credit card number as an "access device," and trafficking in unauthorized access devices is a felony. Convictions can bring prison time, fines, restitution, and a permanent record that blocks most financial and government jobs. Additional charges often stack on top, including wire fraud, identity theft, and money laundering when crypto payments are involved.
- Buying: conspiracy and trafficking charges even if the card was never used.
- Selling: trafficking in counterfeit or unauthorized access devices.
- Using: fraud, identity theft, and often state-level charges.
How does stolen card data reach these marketplaces?
Card details leak through phishing pages, malicious skimming scripts injected into checkout pages, payment terminal tampering, malware on personal devices, and large merchant data breaches. Fraud rings then bundle the records and resell them. This is why card issuers and merchants invest in tokenization, encryption, and real-time fraud scoring.
What are the warning signs of a CVV shop pitch?
These offers usually arrive through chat apps, forums, or spam email and demand payment in cryptocurrency. They use slang such as "fullz," "dumps," or "fresh" cards and promise guaranteed balances, which is a hallmark of a scam. Since the seller cannot be reported to any authority without exposing the buyer, most transactions end with the buyer losing money and receiving nothing usable.
How do legitimate merchants protect card data?
Compliant merchants follow the PCI Data Security Standard, which forbids storing the CVV after an authorization is complete. They also use EMV chip authentication, 3D Secure challenges for online orders, and network tokens that replace the real card number during checkout. These controls make intercepted data far less useful to a criminal.
How can you protect your own card from carding?
- Turn on transaction alerts and lock the card instantly from your banking app.
- Use a virtual card number for unfamiliar websites and subscriptions.
- Avoid saving card details in browsers and merchant accounts you rarely use.
- Check ATMs and gas pumps for loose or bulky card readers before inserting a card.
- Use a unique password and two-factor authentication on every shopping and bank account.
What should you do if your card is used without your permission?
Freeze the card in your issuer's app and call the number on the back of the card to dispute the charges. Under the Fair Credit Billing Act, credit card holders generally face no more than $50 in liability for unauthorized use. Then report the incident at IdentityTheft.gov and file a complaint with the FBI's Internet Crime Complaint Center so the pattern is documented.
Is there ever a legal reason to search for a CVV shop?
Security researchers, fraud analysts, and journalists study these marketplaces to understand criminal tactics and to help banks block them. That work happens inside sanctioned research programs, with legal counsel and never by purchasing card data. For everyone else, the answer is simple: avoid these sites and report them.