What an instant delivery CVV shop sells
A CVV is the 3 or 4 digit code printed on a payment card. It exists to prove the person at checkout holds the physical card. An instant delivery CVV shop sells card numbers, expiry dates, cardholder names and CVV codes, released by an automated bot after a crypto payment. The goods are stolen payment credentials. Legitimate card networks do not distribute CVV data this way, and no bank or processor sells it to the public.
The legal position in the US
Buying card data is access device fraud under 18 U.S.C. 1029. The statute covers producing, trafficking in, and possessing unauthorized access devices. Statutory maximums run from 10 to 15 years, with restitution and forfeiture added at sentencing. Prosecutions for carding rings are routine and many start with a single bulk purchase.
Why most orders fail
- Card life is short. Issuers cancel and reissue cards once fraud models flag them, which can happen within hours of a breach.
- Cardholder liability is capped. The Fair Credit Billing Act limits a cardholder's exposure to 50 dollars, and most issuers waive even that. Disputed charges reverse.
- 3-D Secure blocks card-not-present charges that fail an authentication step.
- Address Verification Service mismatches decline the authorization.
- Many shops are exit scams. Buyers send irreversible crypto and receive dead data, duplicate records, or nothing.
Parameters that matter for CVV handling
- Storage: PCI DSS Requirement 3.2 prohibits retaining the CVV after authorization. Tokenize instead.
- Verification: send CVV2 to the issuer at authorization, then discard it.
- Authentication: apply 3-D Secure to card-not-present orders above a set value.
- Velocity: cap attempts per card, per IP, and per device.
- Monitoring: track chargeback ratios and refund patterns by merchant category.
Pitfalls for buyers and for merchants
Buyers face felony exposure, irreversible payment loss, and data collection by the shop itself. Some shops log buyer wallets, addresses, and IPs, then resell that list or use it for extortion. Merchants face fines and loss of card processing when they store CVV data, even in logs or support tickets. Public counts of active CVV shops are not reliable, and takedown volume varies by quarter, so treat any figure as an estimate.
If a card was charged without authorization, call the issuer and file reports with the FTC and the FBI's IC3.