What a CVV shop sells
A CVV shop is a site that lists card numbers with the three- or four-digit verification code. Sellers label the goods "CVV," "dumps," or "fullz." The data comes from breaches, skimmers, and phishing pages. No seller owns the accounts it lists.
US law covers this under 18 U.S.C. § 1029, the access device fraud statute. Buying, selling, or holding card numbers with intent to use them is a federal crime. Statutory penalties reach 10 years for a first offense and 15 years for later ones.
Is Buying CVV from a Legit Shop Safe and Cheap?
Why "legit" and "cheap" claims fail
- No shop can verify a card. Issuers do not license card data to third parties.
- Low prices track low validity. Sellers price drained or closed cards at a discount and live cards at a premium.
- Payment runs on crypto or gift card codes. There is no chargeback path.
- Exit scams are common. The storefront closes, the account balance is gone.
- "Checker" tools and "refund" policies come from the same operators as the store.
The FBI Internet Crime Complaint Center and the FTC both log payment card fraud complaints. Recovery of money sent to a carding site is rare.
What the CVV code does in a real purchase
The code proves the buyer holds the physical card. Visa and Mastercard print three digits on the back. American Express prints four on the front. PCI DSS Requirement 3.2 bars merchants from storing the code after authorization. A seller that asks for a CVV in email, chat, or a text message is not running a normal payment flow.
Checks before you enter card data
- The address bar shows HTTPS and the merchant's own domain.
- The payment form sits on the processor's domain, not inside the store page.
- Refund, shipping, and cancellation terms appear before checkout.
- The issuer app shows the charge at the moment it posts.
- The merchant does not ask for the CVV by phone or message after the order.
If someone offers you card data
Do not send money. Keep the messages and the account details. Report the contact to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. If your own card number leaked, call the issuer, ask for a replacement card and a new code, and read the last 12 months of statements.
Bottom line
A shop that advertises cheap card numbers is selling stolen data or selling nothing. Both outcomes cost the buyer. Legitimate card security work happens on the merchant side: tokenization, PCI DSS scope reduction, and address verification. None of it involves buying a card number from a storefront.