A "dark web CVV vendor" is a seller who advertises stolen card numbers together with the three or four digit security code printed on the back. That is the whole product. If you landed here because you saw your own card offered in a listing, or because you were curious whether any of it is real, the short answer is this: the market runs mostly on fraud aimed at other criminals, buying in is a federal felony in the US, and the data goes stale within days. Your time is better spent on the defenses at the bottom of this page.
2024 Dark Web CVV Market: A Shopper's Security Guide
What a listing actually contains
A typical entry pairs the 16 digit primary account number with the expiry date and the CVV2, plus the cardholder name, billing ZIP, country of issue, and the first six digits (the BIN) that identify the issuing bank. Some vendors throw in a Social Security number or date of birth and call it "fullz." Others sell "bases" in bulk, thousands of rows in a text file, priced by country and card tier.
Here is the part buyers tend to skip. A CVV is not a key. It is one data point that a payment gateway checks alongside the number, the expiry, and usually the billing address, the merchant's fraud rules, and 3-D Secure. A stolen code with no matching approval path buys nothing. Once the real cardholder disputes the charge, the transaction reverses and the merchant eats the loss.
Why the market is mostly fraud-on-fraud
I treat every vendor screenshot as theater until proven otherwise, and it rarely is. The recurring patterns:
- Rippers. The seller takes payment in crypto and disappears. No escrow, no recourse, no support desk that answers.
- Recycled and dead data. Cards get reissued after a breach. A batch that was live in March is noise by May, and vendors resell it anyway.
- Checker bait. "Free samples" exist so you will burn them on a payment form, which hands the seller a fresh signal about which numbers still work.
- Law enforcement. Carding forums and marketplaces get seized or run as honeypots with some regularity, and the logs are not deleted.
The mechanics also work against the buyer. Issuers watch for card testing: clusters of small authorizations, mismatched geolocation, odd device fingerprints. That pattern triggers declines and account freezes fast. Chargebacks pile up on the merchant side, which is why card-not-present fraud gets flagged so aggressively in the first place.
The legal exposure in the US
Trafficking in stolen account numbers falls under 18 U.S.C. § 1029, access device fraud. Penalties run up to 15 years for aggravated cases, and the statute covers attempts and possession with intent, not just completed purchases. Add identity theft charges under § 1028 when names and SSNs are involved, plus wire fraud for the payment side. Prosecutors do not need you to have successfully used a card. Intent plus the transaction is enough.
There is a practical cost too. Crypto payments are traceable at the exchange on-ramp, and buyers who never touched a card still show up in seized vendor records.
How card data ends up in those batches
Skimmers on fuel pumps and ATMs, point-of-sale malware at small merchants, phishing pages that clone a checkout, insider theft at a processor, and plain old data breaches. Card-not-present channels leak differently: a support agent who writes down a number read over the phone, an unencrypted order export, a help desk that accepts card details by email.
Defenses that actually reduce your exposure
- Turn on transaction alerts for every charge, not just charges above a threshold. Small test authorizations are the tell.
- Use the freeze or lock switch in your banking app when a card is not in active use.
- Prefer virtual card numbers for online subscriptions and one-off sites. A leaked virtual number dies with the merchant.
- Use tap-to-pay or a wallet where you can. Tokenization means the merchant never sees your real number or CVV.
- Never send card details by email or text, and never read a CVV aloud to an inbound caller who claims to be from your bank.
- Read statements line by line once a month. Disputes have windows, and they close.
If you run a store
Requiring a CVV does not authenticate anyone. It is a static value that a thief with the card data already has. What moves the needle: 3-D Secure challenges on risky orders, address verification, velocity limits per card and per device, and tokenized checkout so the number never touches your servers. Keep CVV out of your databases entirely, since storing it after authorization violates PCI DSS.
If your card shows up in a listing
Freeze the card, call the issuer from the number on the back, and request a new number. Dispute anything you do not recognize. Then pull your credit reports and consider a freeze with all three bureaus. Report the incident to the FTC and to the FBI's Internet Crime Complaint Center, which uses those reports to map the vendor networks.