A CVV shop website is an illegal storefront that sells stolen card numbers bundled with the three- or four-digit security code printed on the plastic. There is no legitimate version of this business. When a site advertises "fresh CVVs," "dumps," or "fullz" for sale, it is fencing stolen financial data, and anyone who buys from it is committing card fraud. The rest of this guide is about recognizing that ecosystem, avoiding it, and keeping your own code out of it.
What the term actually covers
In card security, the CVV is a verification value. Visa calls it Card Verification Value, Mastercard uses Card Validation Code, and American Express prints a four-digit code on the front. The whole point is confirmation that whoever is typing the number has the physical card in hand. That single design goal is why the code is worth so much to a criminal and why it is so tightly controlled on the merchant side.
A "CVV shop" flips that purpose. It sells the code as a standalone product, usually alongside the card number, expiry, cardholder name, and sometimes billing address and Social Security number. Listings get sorted by card brand, issuing bank, and country, which tells you the inventory came from breaches, skimming devices, or phishing kits rather than from any bank.
Why the code is the valuable part
Card numbers leak in bulk. A number alone often fails at checkout because the issuer wants the code, an address check, or both. That mismatch is the entire reason card-not-present fraud is harder than it used to be. When a stolen card arrives with a matching code and billing ZIP, it clears more checkpoints in one pass. So the shop sells convenience: a bundle that behaves a little more like a real customer.
The market is smaller and shadier than the marketing claims
These sites put on a show. Uptime counters, "verified seller" badges, escrow promises, Telegram support. I would not take any of it at face value. The operators are criminals selling to other criminals, and the most common outcome reported by buyers is not a working card, it is a drained crypto wallet after a "deposit" or a "verification fee." Fraud against fraudsters is routine because nobody in that transaction can call a bank or file a chargeback.
There is a second cost that buyers tend to forget. To pay, you hand over an identity, a wallet, or a contact handle to people who already make a living from stolen data. That information gets reused or resold. You become inventory.
Why buying is a losing move
- It is a federal crime in the US under identity theft and access device statutes, and prosecutors charge buyers as well as sellers.
- Card issuers and networks flag these purchases, and banks close accounts over suspected carding activity.
- Nothing about the transaction is enforceable. No refunds, no support, no recourse.
- Your own device and payment details land in a criminal's hands.
Red flags on an ordinary checkout page
Most people never visit a CVV shop on purpose, but they do land on cloned storefronts. The tells are consistent: prices far below retail, a checkout that only accepts gift cards, crypto, or bank transfer, a form that asks for the code by email or chat, and a site with no physical address or return policy. Legitimate processors never ask you to send a security code through a message. The FTC has warned consumers for years about card details requested by email or text, and that advice has not aged.
Protecting your own code
- Type the code only on a checkout page you reached yourself, with a padlock and a domain you recognize.
- Never read it aloud on a call you did not initiate and never send it in a message.
- Turn on transaction alerts so you see a charge the moment it posts.
- Use a virtual or tokenized card number for unfamiliar merchants, which limits what a breach exposes.
- Check your statements monthly. Small test charges often come before a large one.
If you run the merchant side
PCI DSS is blunt about this: the verification code is sensitive authentication data and must not be stored after authorization, in any form. Collect it, pass it to the processor, and let it go. If your gateway or your support team keeps codes in a ticket system or a spreadsheet, you have built the raw material for the next CVV shop. Ask your acquirer for tokenization so repeat customers do not require the code at all. That single change removes the most sellable piece of data from your environment.
The short version: a CVV shop website is a fraud marketplace dressed as a store. The safe path is the boring one. Keep the code where it belongs, on the card and in the checkout field, and treat anyone who asks for it anywhere else as a threat.