Short answer
A "dark web CVV shop list" is not a resource you can use. The term describes directories of criminal marketplaces that trade stolen card numbers, expiration dates, and CVV codes. Buying, selling, or knowingly using that data is card fraud under 18 U.S.C. § 1029 and comparable laws in most countries. No legitimate list of these shops exists, and any page claiming to offer one is usually a scam, a law enforcement operation, or a malware drop. The practical goal is the opposite one: keep your own card data out of those markets.
What a stolen card listing contains
Sellers package data in fields that mirror a checkout form, which is why the phrase "CVV shop" stuck:
Buying Guide: Safe and Cheap CVV/CVC for Online Purchases
- Full card number (PAN)
- Expiration date
- CVV or CVC code
- Cardholder name and billing ZIP code
- Issuing bank and card type, often grouped by BIN range
Listings that add a Social Security number, address, or login credentials are marketed as "fullz" and priced higher. A large share of inventory is stale, recycled, or invented. Fraud forums carry regular complaints from buyers who paid for cards that were already blocked.
How card data reaches those markets
- Skimming. An overlay on a gas pump, ATM, or POS terminal copies the magnetic stripe and captures the keypad entry.
- Web skimming. Injected JavaScript on a checkout page copies what a shopper types into the payment form and sends it to an attacker-controlled server.
- Merchant breach. A payment database is taken because card numbers were stored unencrypted or never tokenized.
- Phishing. A message about a failed delivery, refund, or subscription renewal leads to a page that asks for card details again.
- Enumeration. Automated tools test card number ranges and expiration dates against weak payment endpoints that do not rate-limit attempts.
How to check whether your card is exposed
- Read every statement line by line for small test charges, often under two dollars, that precede a larger fraudulent purchase.
- Turn on real-time transaction alerts in your card issuer's app so a purchase you did not make reaches you within seconds.
- Check your credit reports at AnnualCreditReport.com for accounts you never opened.
- Search your email address in a breach notification service to see whether a merchant that holds your card data was compromised.
Steps to keep your card off these lists
- Request a virtual card number from your issuer for online purchases, and set a spending limit for each merchant.
- Use a credit card instead of a debit card online. Credit disputes protect your cash balance while the claim is reviewed.
- Type the merchant's address into the browser yourself rather than following a link from an email or text.
- Confirm the checkout page uses HTTPS and that the payment form is a hosted field or iframe from the processor.
- Decline to save card details on any site that does not need them for recurring billing.
- Keep a separate email address for shopping so phishing attempts stand out from real bank mail.
- Freeze your credit with all three bureaus if you have no plans to apply for new credit in the next month.
If your card number is already circulating
- Call the number on the back of your card and ask for a replacement with a new number, not just a new expiration date.
- Dispute each unauthorized charge in writing inside the window your issuer allows, and keep a copy.
- Change the password on every shopping account that stored the card, and enable two-factor authentication.
- Report the theft to the Federal Trade Commission and to the FBI's Internet Crime Complaint Center.
If you run an online store
- Never store CVV or CVC values after authorization. PCI DSS prohibits retaining sensitive authentication data.
- Tokenize card numbers so your database holds a reference value instead of the PAN.
- Load payment fields in a hosted iframe so raw card data never reaches your servers.
- Apply a content security policy to checkout pages and monitor for script changes.
- Rate-limit and monitor authorization attempts for card testing patterns from a single IP range.
Bottom line
There is no useful or legal dark web CVV shop list. Treat every mention of one as a signal that the card data trade is active, then reduce your own exposure: virtual numbers, credit over debit, alerts on, and fast reporting when something looks wrong. Store owners carry the other half of the burden by refusing to store CVV data and by tokenizing anything that must be kept.