A CVV shop website is an illegal marketplace that sells stolen card verification values (CVVs) and full payment card records to fraudsters. It is not a payment service, not a security tool, and not something a legitimate shopper or merchant ever needs. If you arrived here searching for one, the useful answer is this: the data on those sites is stolen, using it is a crime, and the sites themselves often rob the people who buy from them.
The term CVV shop website, explained
A CVV shop website is a storefront, usually on the open web or a hidden forum, that packages stolen payment data into listings. Common formats include:
- Card dumps: the magnetic stripe data needed to clone a physical card.
- CVV or carding listings: card number, expiration date, name, billing ZIP, and the three or four digit security code.
- Fullz: a bundle that adds the cardholder's address, phone number, or Social Security number.
- Checkers and BIN tools: utilities that test whether a stolen number still works, which are also illegal to run against a card you do not own.
Where the data comes from
Stolen card data reaches these shops through phishing pages, skimming scripts injected into compromised checkouts, malware on a shopper's device, and breaches at merchants or payment processors. A single batch gets resold many times, so a card listed on a CVV shop website is often already canceled by the time a buyer receives it. That is one reason buyers so often pay and get nothing usable back.
Why buying or selling this data is illegal
Trafficking in stolen card numbers and access devices is a federal crime in the United States, and comparable laws exist in most other countries. Law enforcement seizes card shop domains and pursues operators, and repeat buyers have been prosecuted as well. Beyond the legal exposure, these marketplaces are built to defraud their own customers: deposit crypto, receive dead records, no recourse.
What a CVV actually does in a real checkout
The code, called CVV, CVC, or CVV2 depending on the card network, is the three or four digit number printed on the card. Its only job is to show that the physical card is in the buyer's hand when the card is not swiped at a terminal. In a normal purchase you type it into a payment form on a PCI-compliant checkout page, the issuer verifies it, and its role in that transaction ends.
The PCI DSS standard forbids merchants and processors from storing the CVV after authorization, even in encrypted form. That rule is the reason no honest business can sell your code. It is not permitted to keep it once the sale clears.
How to protect your own CVV and card
- Use virtual or single-merchant card numbers for stores you do not know.
- Never send a CVV by email, chat, text, or social message. No real merchant asks for it that way.
- Turn on transaction alerts for every card and actually read them.
- Avoid saving cards in browsers on shared or public devices.
- Review statements every week rather than every month, so a small test charge does not grow into a large one.
- Favor merchants that use network tokenization at checkout, which replaces the card number with a token after the first verification.
Warning signs at checkout
- Prices far below market on in-demand items.
- Crypto-only payment with no refund path.
- No business address, no return policy, no phone number.
- A payment page outside the merchant's own domain with no security indicators.
- Pressure to move the conversation to a messaging app before paying.
If your card data shows up for sale
- Call the card issuer and freeze the account.
- Dispute every charge you do not recognize. The Fair Credit Billing Act limits your liability for unauthorized credit card use.
- Report the incident at IdentityTheft.gov and file a complaint with the FTC.
- Report the site to the FBI's Internet Crime Complaint Center.
- Change passwords on any account that shared the same login, and switch on two-factor authentication.
- If more than the card number leaked, place a fraud alert or credit freeze with the credit bureaus.
Reporting a CVV shop website you find
Do not enter credentials or card details to test it. Note the domain, capture a screenshot, and send it to the FTC and the IC3. Takedown requests also go to the hosting provider and the domain registrar, and most card networks and banks run dedicated abuse reporting channels.