A "CVV shop" is an illegal marketplace that sells stolen payment card data, and "dumps" are the data copied from a card's magnetic stripe or chip. No legitimate business sells either one. Buying, selling, or using this data is a federal crime in the United States under 18 U.S.C. Section 1029, and the cards sold in these shops come from victims whose accounts were breached, skimmed, or phished. The guide below explains how these operations work, why every transaction in them is a crime, and the concrete steps that keep your own card data out of them.

sell cvv on shop

What the Terms Mean

Card data sold in these shops falls into two broad categories, and sellers price them differently based on how much information each record contains.

Sell CVV Cheap From Shop: What Those Listings Really Are

  • CVV listings: A card number, expiration date, and the three or four digit security code, sometimes bundled with the cardholder's name, address, and phone number.
  • Dumps: The raw track data read from a magnetic stripe, which criminals re-encode onto blank cards to make counterfeit copies.
  • Fullz: A package that adds personal identifiers such as date of birth or account login details to make the stolen record easier to abuse.

The naming varies. The underlying goods do not. Every listing represents a real person's account and a real loss.

read more

How These Operations Work

The supply chain behind a CVV shop follows a predictable pattern, which is why the same cards reappear across several sites.

related article

  1. Data is captured through a breach at a merchant or processor, a skimmer placed on a terminal or fuel pump, or a phishing page that mimics a checkout screen.
  2. The stolen records are sorted and tested in small transactions to confirm the accounts are still open.
  3. Verified records are listed for sale in batches, often priced by the cardholder's country and account balance.
  4. Buyers attempt to convert the data into goods or cash before the cardholder or issuer notices.

Shops often run on bulletproof hosting, rotate domain names, and accept only cryptocurrency to make takedowns and refunds difficult. Many are outright scams that take a buyer's payment and deliver nothing, which is one reason law enforcement sees constant disputes inside these forums.

Why Buying or Selling Is a Crime

Trafficking in stolen access devices carries serious penalties in the US, including prison terms and fines that scale with the number and value of the accounts involved. Related charges commonly include wire fraud, identity theft, and conspiracy. Possession of counterfeit or unauthorized access devices is itself chargeable. There is no legal dealer, no licensed reseller, and no compliant use case for a shop that sells card numbers by the thousand.

How to Protect Your Card Data

These steps reduce the chance your card ends up in a dump file.

  1. Pay with a credit card rather than a debit card for online purchases, since credit cards carry stronger fraud protections and limit direct access to your bank balance.
  2. Use a virtual or single-use card number from your issuer for unfamiliar merchants and subscription trials.
  3. Check the checkout page URL before typing card details, and never enter them after following a link from an email or text message.
  4. Turn on transaction alerts in your banking app so a charge you did not make reaches you within minutes.
  5. Inspect card readers at gas pumps and ATMs for loose or bulky overlays before inserting your card.
  6. Freeze your credit when you are not actively applying for new accounts, and review statements line by line every month.
  7. Keep your card's security code out of any email, chat, or note, since no legitimate merchant or support agent asks for it in writing.

If Your Card Is Already Compromised

  1. Call the number on the back of your card and report the unauthorized charges, then request a replacement card with a new number.
  2. Change passwords on any shopping account where the card was saved, and enable multi-factor authentication.
  3. File a report at IdentityTheft.gov and keep the confirmation number for your records.
  4. Dispute the charges in writing within the window your issuer sets, and keep copies of everything you send.

For Merchants and Site Owners

  1. Never store the card security code after authorization, and tokenize card numbers so your systems never hold raw data.
  2. Use a PCI DSS validated payment processor and keep your checkout page hosted on their infrastructure.
  3. Monitor for card testing patterns, such as bursts of small declined orders from one IP range, and block them early.
  4. Require the security code and address verification on every order to raise the cost of using stolen data on your site.

Card security codes are a deterrent, not a guarantee. The most effective defense is to treat every card number as data worth stealing and to limit where it lives.