The short answer
A "CVV shop website" is an illegal storefront that sells stolen payment card data, and a "dump" is a copy of the data encoded on a card's magnetic stripe. There is no legitimate version of this market. Buying, selling, or using that data is credit card fraud under federal law, the cards are dead within days most of the time, and a large share of these shops exist to rob the people who buy from them. If you came here looking for protection, the useful part is understanding how card data gets stolen and what actually stops it.
What the vocabulary means
The slang on these sites shows up in news coverage and merchant risk reports, so it helps to know it.
- CVV / CVC / CVV2: the three or four digit code printed on a card. It exists to prove the person typing the number is holding the physical card.
- Dumps: magnetic stripe data, the tracks a reader pulls when you swipe. Dumps are used to make cloned cards.
- Fullz: a bundle of personal data (name, address, birth date, sometimes a Social Security number) paired with account numbers.
- Carding: the umbrella term for fraud built on stolen card data.
Retail card fraud is downstream of a theft somewhere else: a skimmer on a gas pump, a phishing page, a breach at a merchant, malware on a point-of-sale terminal, or credential stuffing against a store account with a saved card.
CVV Shop Websites for Bitcoin: What They Are and Why They're Illegal
Why the CVV is the hard part
PCI DSS, the standard the card networks enforce, prohibits storing the verification code or full track data after a transaction is authorized. That one rule is why a stolen customer database is painful but not usable right away online. A shop advertising "CVV" for thousands of cards is either working from a merchant-side compromise, collecting codes one at a time through phishing, or just lying about what it holds. The last option is the most common.
How these shops treat their own customers
Anyone who pays for stolen data is dealing with criminals who have no reason to be honest. Common outcomes: cards arrive dead because the real owner reported them the day before; balances get checked and drained before a buyer gets a working number; the site folds overnight and keeps the deposit; the "checker" and escrow services are run by the same people. Law enforcement monitors these forums, and crypto payment trails have been used in prosecutions. Buying in is a good way to become a defendant.
Protecting your own cards online
- Pay with a tokenized wallet or a virtual card number tied to one merchant. Your real number never reaches the site.
- Turn on transaction alerts for every card and read them. Cardholders catch most fraud, not banks.
- Shop where checkout uses 3-D Secure or step-up authentication. It triggers a prompt from your bank and blocks a card number used without your device.
- Skip any store that asks for the CVV over email, chat, or phone. No legitimate processor needs that.
- Keep one card for online use and a different one for everyday purchases. It limits the blast radius.
If your card number leaks
Call the issuer and ask for a new number. Federal law caps your liability for unauthorized credit card charges at $50, and most issuers go to zero, but that protection depends on reporting fast. Then file at IdentityTheft.gov, and if money was taken or an account was opened in your name, file with the FBI's Internet Crime Complaint Center. Payment card fraud falls to the U.S. Secret Service and its cyber fraud task forces, so a complaint helps build a case even when your own loss is small.
Bottom line
CVV shops and dumps are a crime economy, not a shortcut. The data is stolen, the sellers are thieves twice over, and the buyers are the easiest marks in the room. Put that energy into tokenized payments, transaction alerts, and a card you can freeze in one tap.