What the term covers
A dark web CVV site is a marketplace that runs on a Tor hidden service and sells stolen payment card records. Buyers pay in bitcoin or another cryptocurrency. A listing carries the card number, expiration date, cardholder name, and the CVV: the 3 digit code on the back of a Visa, Mastercard, or Discover card, or the 4 digit code on the front of an American Express card.
These sites change addresses and names. Takedowns and exit scams close them. The FBI seized AlphaBay in July 2017 and Genesis Market in April 2023. Hydra, a Russian marketplace, went down in April 2022.
Buy CVV on Dark Web Instant: A Comprehensive Buying Guide
How listings are sorted
Dumps
A dump is magnetic stripe track data. It holds the account number, expiry, and service code. Dumps come from skimmers and point of sale malware.
Fullz
A fullz package adds the cardholder name, billing address, phone number, date of birth, and in some cases a Social Security number. Fullz sell for more than a bare card number because they pass address verification checks.
Bank logs
Bank logs are account credentials for online banking. Listings range from a few hundred dollars to several thousand.
Prices
Public reporting places a single United States card with a CVV at $10 to $30. Cards from banks with weak verification sit at the low end. Fullz sell from $30 to $100 and up. Escrow holds payment until the buyer confirms the card works, which drives disputes and refunds.
Payment rails
Bitcoin is pseudonymous, not anonymous. Every transfer lands on a public ledger. Analytics firms cluster addresses and tie them to exchanges that hold identity records. Some marketplaces moved to Monero to avoid that trail, and some keep an internal balance system so no coins move per order.
Where the data comes from
- Skimming devices on fuel pumps, ATMs, and card readers
- Phishing pages that copy a bank or retailer login
- Magecart scripts injected into checkout pages
- Merchant database breaches
- Insider theft at call centers and payment processors
- Credential stuffing against stored card wallets
Why CVV checks block most of it
PCI DSS Requirement 3.2 forbids storage of sensitive authentication data after authorization. That covers the CVV, full track data, and the PIN block. A stolen card number with no matching CVV fails the check at checkout. Merchants that request the CVV on every card-not-present order and use 3-D Secure cut card testing and shift fraud liability.
Address Verification Service compares the billing address and ZIP code. It does not prove the buyer holds the card. CVV and 3-D Secure add that layer. Card testing shows up as bursts of small authorization attempts, often $1 or less, from one IP range.
What cardholders can do
- Freeze the card in the issuer app when it is not in use
- Turn on alerts for every transaction over a set amount
- Use virtual card numbers that expire after one merchant
- Review statements each month and report charges that are not yours
Under the Fair Credit Billing Act, a disputed charge reported within 60 days caps cardholder liability at $50. Most issuers waive it.
Enforcement record
Chain analysis supports prosecutions. Operation DisrupTor in 2020 produced 179 arrests across the United States and Europe. After the FBI took Hansa in 2017, agents ran the site for a month and logged user activity.
Bottom line
Stolen CVV data has a market because some checkouts still accept a card number and expiry without a second factor. Strong CVV handling, tokenization, and 3-D Secure remove the value of a leaked number.