Short answer
A CVV shop is an illegal marketplace that sells stolen payment card data. The phrase sell dumps refers to dump data: the contents of a card magnetic stripe, written as Track 1 and Track 2 strings. The two product types overlap. A CVV listing carries a card number, expiry date, cardholder name, and the 3 or 4 digit verification code. A dump listing carries stripe data used to write a cloned card. Both are criminal goods under US federal law.
Terms used in these markets
- CVV or CVC: 3 digits on the back of Visa, Mastercard, and Discover cards; 4 digits on the front of American Express cards.
- Dumps: Track 1 and Track 2 stripe data, sold with a BIN and a region code.
- Fullz: a bundle with name, address, Social Security number, date of birth, and card data.
- Checker: a service that tests a stolen card number against a live payment gateway.
- BIN: the first 6 to 8 digits of a card number, which identify the issuing bank and card type.
Why the trade is illegal
18 U.S.C. 1029 covers fraud and related activity in connection with access devices. Selling, transferring, or possessing card data with intent to defraud carries a prison term of up to 10 years for a first offense and up to 15 years for a second. The same statute makes possession of 15 or more counterfeit or unauthorized access devices an offense on its own. Buyers and sellers fall under the same section. Card fraud losses worldwide run in the tens of billions of dollars each year, based on Nilson Report estimates.
How the data gets taken
- Skimming: a hidden reader on a fuel pump or ATM copies stripe data and PINs.
- Breaches: a retailer or payment processor loses stored card records.
- Phishing and smishing: a message sends the cardholder to a fake payment page.
- Magecart: a script injected into a checkout page reads form fields as they are typed.
Defenses on the merchant side
PCI DSS Requirement 3.2 forbids storage of sensitive authentication data, including the CVV, after authorization. Tokenization replaces the card number with a surrogate value that has no use outside one merchant. Chip cards made cloned stripe data fail at most US terminals after the October 2015 liability shift, and card-not-present fraud moved to online channels after that shift. 3-D Secure 2.0 adds an issuer challenge step during checkout. Address Verification Service checks the billing street number and ZIP code against the issuer record.
Sell CVV to Shop: What That Search Really Leads To
Defenses on the cardholder side
Under the Fair Credit Billing Act, liability for unauthorized credit card charges is capped at $50. Report a lost card before misuse starts and liability is zero. Turn on transaction alerts. Use a virtual card number for online merchants. Read the statement each month.
Reporting
File card fraud complaints with the Federal Trade Commission and with the FBI Internet Crime Complaint Center. Credit card fraud ranks among the top complaint types IC3 receives each year. Issuers also take reports by phone, 24 hours a day, through the number printed on the back of the card.