Pick first
No site that sells CVV data is legitimate. A search for "CVV website for carding" returns pages that list card numbers for sale. Those pages break US law. 18 U.S.C. section 1029 covers access device fraud. Card data sold on those pages fails at checkout in most cases, and the seller keeps the payment.
For a merchant, the first pick is a CVV requirement at checkout plus tokenization. This pair blocks stored-card misuse and cuts chargebacks.
Option 1: CVV requirement at checkout (first pick)
Ask for the 3 or 4 digit code on each order. Do not store the code. PCI DSS bans retention of the CVV after authorization. Order pages that keep the code in a database fail an audit.
Buying Guide: How to Safely Buy CVV/CVC for Online Purchases
Option 2: Tokenization
Replace the card number with a token. The token maps to a card in a vault. A breach of the order database then yields tokens, not card numbers. Tokenization covers repeat buyers and subscription billing.
Buying CVV Data Online: Why Carding Sites Are Scams and Crimes
Option 3: 3-D Secure
3-D Secure adds an issuer check step. A pass moves fraud liability to the issuer for that transaction. The cost is friction. Conversion drops on some checkouts. Test the step on a slice of traffic before a full rollout.
Option 4: Address Verification System
AVS compares the billing address digits to the issuer record. It returns a code with the authorization. Use AVS with the CVV check. AVS alone misses stolen cards with a matching ZIP.
Carding sites: what a review can and cannot confirm
Review pages for carding sites repeat claims about "fresh" data and "high balance" cards. No reviewer can verify a stolen card. The data has no warranty. Public reports to the FBI IC3 describe buyers who pay and get nothing. Site names change.
Legal risk sits with the buyer. Section 1029 covers possession of 15 or more unauthorized access devices with intent to defraud. That count is a felony.
Legitimate alternatives to a carding site do not exist. If a page offers card data for sale, treat it as fraud.