Why This Guide Does Not Teach Purchasing
A "CVV shop" is a marketplace that sells stolen payment card numbers paired with the three or four digit security code printed on the card. Buying, selling, or using that data is access device fraud under federal law in the United States, and every transaction on those markets is a crime on both sides of the deal. There is no safe procedure, no reputable vendor, and no buyer protection. What this guide covers instead is the part you can act on: how the CVV works, how merchants verify it, how to keep yours out of those markets, and what to do when it leaks.
What the CVV/CVC Does
The card verification value is not a password you own in the same way as a PIN. It exists to prove that whoever is typing the number is holding the physical card. That is why card networks and the PCI Data Security Standard forbid merchants from storing it after a transaction is authorized. When a breach happens, the CVV is the piece attackers most want, because it lets a stolen number pass a basic card-not-present check.
Step by Step: Protect Your CVV During Online Purchases
- Use a virtual card number from your issuer for subscriptions and unfamiliar stores.
- Confirm the checkout page is served over HTTPS before you type anything.
- Type the card number and CVV manually instead of pasting from a note or clipboard.
- Decline sites that ask you to email or chat your full card number and CVV.
- Keep a separate card with a low limit for online use only.
- Turn on transaction alerts in your banking app.
Step by Step: If Your Card Number and CVV Leak
- Call the number on the back of your card and report it as compromised.
- Ask the issuer to freeze the account and issue a new number.
- Review every charge from the past 60 days and dispute the ones you did not make.
- File a report at IdentityTheft.gov if your personal data went out with the card.
- Change the password on any account where that card was saved.
Red Flags of CVV Shop Scams
Beyond the legal exposure, buyers on these markets are the easiest target in the room. Sellers take payment in cryptocurrency that cannot be reversed and then deliver nothing, deliver already-drained numbers, or reuse the same list across dozens of buyers. Escrow offers are run by the same people. Sites that advertise "fresh" or "high balance" cards are describing stolen accounts, and the balances they promise disappear the moment the real cardholder files a dispute.
How Merchants Verify CVV in Practice
Legitimate processors check the code through an authorization message and receive a match, no-match, or not-processed response. A mismatch normally declines the order. Merchants cannot see or store the code itself. If any store you deal with tells you it keeps CVVs on file or asks you to re-send one by email, that is a security failure worth reporting to your issuer.