The short answer
A CVV shop is a marketplace for stolen payment card data. Listings pair a card number with the three or four digit verification value, an expiration date, a cardholder name, and often a billing ZIP code. Payment runs through cryptocurrency. There is no legal version of this market. Buying, selling, or using the data is a federal crime in the United States under 18 U.S.C. 1029.
Cheap CVV Shops: Card Data Fraud and the Law
If you landed here looking for a vendor to buy from, the answer is that the category does not have one. The rest of this page explains the mechanics and the defenses.
Where the card data comes from
Three sources supply most of it. Skimmers on fuel pumps and point-of-sale terminals capture track data at the swipe. Phishing pages collect card numbers and codes from cardholders who are told they are confirming a charge. Breaches at merchants that stored data they were not allowed to keep produce the largest batches.
Why a stolen code fails at checkout
Storage rules
PCI DSS Requirement 3.2 bars merchants from storing the card verification value after authorization. A merchant that follows the rule holds the code for one transaction and cannot check it again. The code on a stolen record is a snapshot from one moment.
Issuer scoring
Issuers score each authorization. A new device, an IP address that does not match the cardholder's region, a billing ZIP that does not match the address on file, and overnight shipping raise the score. A high score declines the charge or sends it to a manual review queue.
Tokenization
Tokenization replaces the card number with a value tied to one merchant or one device. A number copied out of a breach does not work at a different merchant because the token does not exist there.
Authentication steps
3-D Secure sends the transaction to the issuer for an authentication check. The cardholder confirms in an app or with a one-time code. A card number alone does not clear that step.
Controls that stop card-not-present fraud
- Run the CVV check at authorization. Never write the value to a database, log, or order record.
- Turn on address verification for the billing street number and ZIP code.
- Set velocity limits per card, per device, and per IP address.
- Match the shipping address to the billing address on first orders.
- Require 3-D Secure above a dollar threshold.
- Review orders that combine a high-value cart with a new account and expedited shipping.
What cardholders should do
Freeze the card in the issuer's app. Read the last 60 days of statements line by line. Report the charge to the issuer in writing, then file a report with the Federal Trade Commission. Identity theft reports filed with the FTC feed the Consumer Sentinel Network, which law enforcement agencies query.
Bottom line
Card verification values are a fraud control, not a product. The 2024 version of this market is the same as every prior version: stolen records, short shelf life, and a decline rate that rises as issuer scoring improves.