Short answer

A "CVV vendor list" is an index of sellers who claim to hold stolen payment card data. No legitimate CVV vendor list exists. Card networks, banks, and payment processors do not sell card numbers or verification codes. Any page, forum post, or marketplace that publishes such a list is either a fraud aimed at buyers, a malware trap, or a law enforcement operation. Buying from one is a federal crime in the United States.

read more

What the lists contain

Most listings follow the same format. A seller posts a batch of card records with fields such as card number, expiration date, cardholder name, billing ZIP code, and CVV. Sellers sort batches by country, card brand, and bank.

where to purchase cvv on dark web

  • CVV, also called CVV2, CVC2, or CID, is the 3-digit code on the back of Visa, Mastercard, and Discover cards, and the 4-digit code on the front of American Express cards.
  • Fullz is slang for a record that includes the cardholder's name, address, date of birth, and Social Security number.
  • Base is slang for a bulk file of card records sold as one unit.

Prices move with supply. Records from banks with weak fraud controls sell for more. Records that a seller claims are "fresh" sell for more than records from an older breach.

Best Dark Web Sites for CVV

Why buyers lose money

Carding markets have no consumer protection. Documented failure modes:

read more

  1. Cards are already canceled. Issuers close accounts after a breach, often before a listing goes up.
  2. The seller takes payment and stops responding. Escrow systems on these forums are run by the same people who run the forums.
  3. The "list" is a phishing page. It asks for a deposit in cryptocurrency and delivers nothing, or it delivers a file that installs credential-stealing malware.
  4. The site is a honeypot. Law enforcement agencies operate or monitor forums and log visitor traffic.

Legal status in the United States

18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. It criminalizes producing, selling, transferring, or using unauthorized access devices, which includes payment card numbers. Penalties reach 10 years for a first offense and 15 years for certain aggravated counts. 18 U.S.C. § 1028 covers identity documents and identity theft. State laws add separate charges.

The FBI and the U.S. Secret Service run carding investigations. The FBI publishes internet crime data through its Internet Crime Complaint Center. The FTC tracks card fraud complaints in its Consumer Sentinel database, where credit card fraud ranks among the top identity theft categories each year.

How card data gets taken

  • Skimming. A device or overlay on a gas pump, ATM, or point-of-sale terminal copies the magnetic stripe.
  • E-skimming. Injected script on a merchant checkout page copies form fields as the shopper types. Magecart is the common term for this class of attack.
  • Breaches. Attackers copy stored cardholder data from a merchant or processor database.
  • Phishing and social engineering. A fake bank page or phone call collects the card number and CVV from the cardholder.

What protects a card

The CVV helps because PCI DSS rules prohibit merchants from storing it after authorization. A thief who steals a database gets card numbers without verification codes. That gap is why card-not-present fraud still happens and why authentication moves to the issuer side.

  • 3-D Secure / EMV 3DS. The issuer challenges the buyer during checkout.
  • Tokenization. A network token replaces the card number in a merchant's systems. Stolen tokens have no use outside one merchant or one device.
  • Virtual card numbers. Banks and card issuers let cardholders generate a one-time number tied to a spending limit.
  • Address Verification Service. The merchant compares the billing ZIP code with the issuer record.
  • Velocity checks. Rule engines flag many orders from one device, IP range, or shipping address in a short window.

Steps for shoppers

  1. Turn on transaction alerts in the card issuer's app.
  2. Read statements line by line. Small test charges often come before a large one.
  3. Use a virtual card number at merchants you do not know.
  4. Do not enter card details on a page reached from an email or text link.
  5. Report fraud to the card issuer first, then to the FTC at IdentityTheft.gov and to the FBI at IC3.gov.

Steps for merchants

  1. Meet the current PCI DSS version for any system that touches card data.
  2. Require the CVV on card-not-present orders. Do not store it.
  3. Run AVS and CVV checks together. One check alone has a high false-negative rate.
  4. Monitor checkout script changes. Subresource Integrity and a Content Security Policy block injected code.
  5. Keep chargeback ratios under network thresholds to avoid monitoring programs.

What is not known

The size of the carding market is an estimate. Researchers base figures on forum samples and takedown reports, so totals vary by source and date. No public dataset counts every seller or every card record.