This page does not list dark web marketplaces. Buying or selling card verification values is fraud under 18 U.S.C. § 1029. The comparison below covers verification methods used by issuers, merchants, and cardholders.
Where to Purchase CVV on the Dark Web: A Buying Guide
Top pick: tokenization with 3-D Secure 2
A network token replaces the 16-digit account number. The merchant stores the token, not the account number. The static 3-digit code never enters the merchant's order database. 3-D Secure 2 adds a risk check at the issuer during checkout. For eligible transactions the issuer carries the fraud loss. This pairing removes the two items that card-data buyers want: a reusable account number and a reusable verification code.
The options
- CVV2 / CVC2 / CVV: 3 digits printed near the signature panel on Visa, Mastercard, and Discover cards.
- CID: 4 digits printed on the front of American Express cards.
- CVV1 / CVC1: a value encoded in the magnetic stripe. Used in card-present reads. Not printed on the card.
- Dynamic CVV: a display or issuer app generates a code that expires. Visa calls its version dCVV2.
- Network tokens: a substitute number tied to one merchant or one device.
- 3-D Secure 2: issuer authentication at checkout, using device and behavioral signals.
How the codes differ
The printed code shows that the person holds the physical card. A thief with a copied number and expiry date fails at the code field. That is the purpose. The code is not a password. It does not change between purchases. It sits in the same place on every card of the same brand.
Dark Web CVV Buying Guide: What You Need to Know
Merchants that store the printed code break PCI DSS Requirement 3. The standard bans storage of sensitive authentication data after authorization. Full track data, PINs, and CAV2/CVC2/CVV2/CID all fall in that group. A merchant that keeps them must document a business need, and storage is barred after the transaction settles.
Best Dark Web Sites for CVV Fullz Comparison Review
Weak points
A static code helps against a stolen number. It does little against a breach at the merchant, because the merchant should not hold the code at all. It also does little against phishing pages that ask for the card number, the code, and a one-time password in the same form. Cardholders who type the code into a page they did not expect to see it on give it away.
What cardholders can do
- Check the charge total before you enter the code.
- Use a virtual card number from the issuer for subscriptions and one-off merchants.
- Turn on transaction alerts in the issuer app.
- Report an unauthorized charge in writing. Under the Fair Credit Billing Act, credit card liability caps at $50.
What merchants can do
Tokenize at the point of capture. Keep the code out of logs, call recordings, and support tickets. Use 3-D Secure 2 for high-risk orders. Card verification is one control among several. Address verification, velocity checks, and device fingerprinting carry the rest of the load.