Short answer
A dark web CVV shop is an illegal marketplace that sells stolen payment card records. A record holds the card number (PAN), the expiration date, the cardholder name, and the 3-digit or 4-digit verification code. Buyers pay in bitcoin or another cryptocurrency. The shop sells data, not a working card. A large share of the records are stale, cancelled, or copied from an earlier breach.
What a listing contains
Most shops use the same field layout.
- Card number and expiration date
- CVV2 or CVC2, the 3-digit code for Visa, Mastercard, and Discover. American Express uses a 4-digit CID printed above the card number.
- Cardholder name, billing ZIP code, and country
- Bank identification number, the first 6 to 8 digits, which name the issuing bank and card type
- In some cases, a date of birth, Social Security number, or email address pulled from the same breach
Shops label records by country, card brand, and balance tier. Reported prices for one record run from $1 to $30. Card type, issuing country, and the amount of cardholder data drive the price.
Why bitcoin is the payment rail
Bitcoin is pseudonymous, not anonymous. Every transfer is written to a public ledger that anyone can read. Chainalysis, TRM Labs, and law enforcement agencies trace those flows and cluster addresses to services. Courts accept the output as evidence.
can i purchase cvv safely on dark web
Mixing services have taken hits. The U.S. Treasury sanctioned Blender.io in May 2022 and Tornado Cash in August 2022. The Department of Justice charged the founder of Bitzlato in January 2023, and FinCEN named the exchange a primary money laundering concern. Buyers who assume bitcoin hides a purchase are working from a false premise.
Shops close without warning
Joker's Stash, one of the largest card shops, announced a shutdown in January 2021 and went dark the next month. In April 2022, German authorities and the U.S. Department of Justice seized Hydra Market and 543 bitcoin tied to it. Prep aid balances vanished with the sites.
Exit scams are routine. An administrator takes deposits, closes the forum, and reappears under a new name. Vendors also resell one record to several buyers, so a card may be drained before a second buyer loads it. Some shop pages carry malware that targets the visitor.
Legal exposure
In the United States, buying or selling stolen card data falls under 18 U.S.C. 1029, the access device statute. A first offense carries up to 10 years. Repeat and aggravated cases carry higher maximums. Sentences stack with identity theft and wire fraud counts.
What protects card data
PCI DSS v4.0 Requirement 3.3.1 prohibits storage of sensitive authentication data after authorization. That set includes the full track data, the card verification code, and the PIN block. Requirement 3.5.1 covers PAN protection through truncation, tokenization, and hashing. A merchant cannot keep the CVV2 after a sale. The code is passed to the issuer during checkout and then discarded.
Three controls cut card-not-present fraud:
- Tokenization. The network swaps the PAN for a token. Apple Pay, Google Pay, and network tokens use this method, so the merchant never holds the real number.
- 3-D Secure. The issuer adds an authentication step during e-commerce checkout. A stolen PAN and CVV2 alone will not clear the order.
- EMV chips. Chip authentication reduced card-present counterfeiting. Fraud moved to online channels where the chip is absent.
Steps for cardholders
- Turn on transaction alerts for each purchase.
- Use virtual card numbers at online merchants. The number can be closed after one use.
- Lock the card in the issuer app when it is not in use.
- Read statements each month and dispute unknown charges within 60 days under the Fair Credit Billing Act and Regulation Z.
- Request a new card and number if a breach exposes the PAN. A CVV cannot be reissued on the same account.
Steps for merchants
- Do not store the CVV2 or CVC2 after authorization.
- Apply 3-D Secure to card-not-present orders.
- Shrink PCI DSS scope with hosted payment fields or network tokens.
- Watch for card testing: many small authorizations from one IP range in a short window.
Report and recover
Cardholders file complaints with the FTC at IdentityTheft.gov, the FBI Internet Crime Complaint Center, and the Consumer Financial Protection Bureau. Merchants report card testing and breach events to their acquirer and to the card network. Issuers replace the account number and reissue the card.
Numbers to keep
- 3 digits: CVV2 or CVC2 for Visa, Mastercard, and Discover
- 4 digits: CID for American Express
- 60 days: cardholder window for billing disputes under Regulation Z
- 10 years: federal maximum for a first access device offense
- 543 bitcoin: seized in the Hydra Market action