Short answer
No public list of CVV shop websites is reliable, and none is legal to use. A CVV shop is a storefront that sells stolen payment card data. That data includes the card number, expiration date, cardholder name, and the three or four digit verification code. The verification code is the CVV or CVC.
Pages that surface under this search term fall into four groups. Stolen data pasted into forums. Affiliate pages for fraud sites. Phishing pages that harvest the credentials of people who hunt for the lists. Police decoy sites.
CVV Shop Website Dumps: What They Are and Why They Fail
What a CVV is
The CVV is a 3-digit code on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The code is not stored on the magnetic stripe and is not printed on receipts. Issuers use it to confirm the card is in hand during a card-not-present transaction.
A card number alone is not enough for most online purchases. That is why the CVV carries value to a thief, and why card networks treat it as sensitive authentication data.
CVV Shop Websites for Bitcoin: What They Are and Why They're Illegal
Why the search leads to harm
- Payment card fraud losses in the US stay in the billions of dollars per year. The FTC lists identity theft among its top consumer complaint categories.
- Sites that claim to sell CVVs often ship nothing, or ship data that has been canceled.
- Buying or selling card data violates 18 U.S.C. 1029. Penalties reach 10 years in prison for a first offense and 15 years for aggravated cases.
- Visiting these sites exposes a device to malware, credential stealers, and session hijacking scripts.
FBI and Secret Service operations have replaced known carding domains with seizure notices. A domain that worked in 2024 may now be a government-controlled page.
What merchants check instead
- Require the CVV on every transaction and never store it after authorization. PCI DSS Requirement 3.2 bars storage of sensitive authentication data post-authorization.
- Use 3-D Secure for cardholder authentication.
- Compare address verification service results and IP geolocation against the billing address.
- Set velocity limits on cards, devices, and shipping addresses.
If your card data leaks
Call the issuer. Dispute the charge. Freeze the card in the issuer app. Request a new number. File a report at IdentityTheft.gov if the data led to new accounts. Keep records of the dispute and the dates.
Unknown
The count of active CVV shops is not published. Any site that claims a current total is guessing.