A CVV shop website list is a directory of sites that sell stolen card data. The lists circulate on forums, chat channels, and file hosts. No legitimate business publishes one. Buying card data, selling it, or running a site that brokers it is a federal crime in the United States. This guide explains what the lists hold, what the law says, and how cardholders and merchants block the fraud behind them.
What a CVV shop is
CVV is the card verification value. Visa calls it CVV2. Mastercard calls it CVC2. American Express calls it CID. The value is 3 digits for Visa, Mastercard, and Discover, and 4 digits for American Express. It is printed on the card and is not encoded on the magnetic stripe.
CVV Shop Websites: Understanding the Dumps and Online Security
A CVV shop is a storefront that sells card numbers taken from breaches, skimmers, and phishing pages. Stock is grouped by bank, country, and card brand. "Fullz" bundles add the cardholder name, address, and Social Security number. Prices run from under $1 for one card record to hundreds of dollars for a verified account with balance data. Sources give different figures year to year.
What 2024 lists contain
Lists posted under this keyword are short-lived. They name domains, mirror addresses, and chat handles. Most entries go dead within weeks after a takedown, a domain seizure, or an exit scam. Common features:
CVV Shop Website for Bitcoin: A Comprehensive Guide
- Prices and "checker" tools that test a card against a payment gateway.
- Escrow claims and vendor ratings that buyers cannot verify.
- Referral links that pay the list author.
Treat any such list as a fraud artifact. It is also a target. Police operations have run fake shops to collect buyer data, and carding forums have been seized in international takedowns.
The law
18 U.S.C. 1029 covers access device fraud. Producing, selling, or holding card data with intent to defraud carries prison terms that reach 10 to 15 years, based on the subsection charged. 18 U.S.C. 1028A adds a mandatory 2-year term, served after the first sentence, for aggravated identity theft. State charges stack on top.
Why the code exists
The code proves the buyer holds the physical card. PCI DSS Requirement 3.2 forbids storage of sensitive authentication data after authorization. That rule is why a merchant cannot keep CVV2, CVC2, or CID in a database, and why a checkout page that asks for it outside a payment form is a red flag.
Protect your card
- Keep the card in sight during a transaction. Cover the keypad.
- Use virtual card numbers from your issuer at online stores you do not know.
- Turn on transaction alerts with a low dollar threshold.
- Read statements each month. Dispute unknown charges inside the window your issuer allows.
- Report fraud to the FTC and to the FBI. Ask your issuer for a new number.
Federal law caps cardholder liability at $50 when a card is lost or stolen and reported. Unauthorized use of the account number alone, with the card still in hand, carries no cardholder liability in most cases.
Criminal exposure for buyers
A buyer holds no legal title to the data and no recourse if the shop folds. Seized funds do not come back. Records kept by a fake shop can end up in a prosecution file. The lower prices on these lists reflect stolen goods, not bargain shopping.