Can You Buy a CVV?
No. A CVV is a security code printed on a payment card, and it is never sold as a product to consumers. Sites that advertise CVV data for sale trade in stolen card numbers, which is a federal crime in the United States. Anyone who pays for one either loses the money to a scam or commits card fraud.
If your goal is to protect your own card or to pay online without exposing your main account, there are legal products for that. This guide covers what the code does, what you can buy, and where the traps sit.
What the CVV Actually Is
The CVV (card verification value) is a short code that proves the person paying holds the physical card. Visa, Mastercard, and Discover print three digits on the back. American Express prints four digits on the front.
Card networks require the code for card-not-present orders, which covers most online and phone purchases. The merchant passes the code to the issuer for a match. A mismatch flags the order for review or decline.
- Three digits on the back: Visa, Mastercard, Discover
- Four digits on the front: American Express
- Not stored in readable form on the chip or magnetic stripe
- Under PCI DSS, merchants may not store it after an order is authorized
Why CVV Listings Exist at All
Carding forums sell stolen account data in bundles. Each bundle holds a card number, an expiry date, a cardholder name, and the CVV. Buyers use those bundles to place orders funded by someone else's account.
Two outcomes follow. The seller takes payment and disappears, or the buyer receives real stolen data and commits a felony. One path costs money. The other costs money and carries prison time.
Federal law treats trafficking in access devices as a felony under 18 U.S.C. Section 1029. Penalties are measured in years per count, and the law applies to the buyer as well as the seller. Card networks also terminate merchant accounts tied to such data.
What You Can Buy Instead
Every legal use case behind the search "I want to buy CVV" has a product that fills it. None of them involve a stranger's card.
Virtual card numbers
Several US banks and fintech apps issue single-use or merchant-locked numbers that sit in front of your real account. You receive a number, an expiry date, and a CVV that belong to you. If a merchant leaks the number, the damage stops there.
Prepaid and reloadable cards
A prepaid card gives you a separate number and code with a spending cap you control. Load what you plan to spend and the exposure stays at that balance. These cards also work for subscriptions when the issuer allows reloads.
Merchant tools for accepting cards
If you sell online, the CVV check is a setting inside your payment gateway. Turning it on blocks a share of stolen-card orders. Expect some false declines from customers who mistype the code.
Fraud alerts on your own accounts
Card issuers let you switch on transaction alerts by text or app. You see each charge as it posts and can freeze the card from your phone. That beats any third-party service, and it costs nothing.
Checklist Before You Pay Any Card Service
- Confirm the provider is a bank, a licensed money transmitter, or a registered payment processor.
- Read the full fee schedule, including setup, per-transaction, and inactivity fees.
- Check refund and cancellation terms before you enter any card details.
- Search the company name plus the word complaint, then check the Better Business Bureau and your state regulator.
- Run a small test transaction before you commit real money.
- Confirm the service is available in your country and state.
Red Flags on Card Data Sites
- Prices listed per card, with bulk discounts
- Slang bundles such as fullz, dumps, or fresh bases
- Payment by gift card, crypto, or wire with no chargeback path
- No company address, registration number, or support phone
- Claims that a card will pass a CVV check
- Telegram channels or forums acting as the storefront
Any one of these signals means stop. Two of them means the page exists to take your money and hand you nothing.
Common Questions
Is buying a CVV illegal in the US?
Yes, when the code belongs to another person's account. Purchasing or selling card data falls under federal access device fraud statutes. There is no consumer market where a stranger's CVV is a legal product.
Can I buy a CVV for my own card?
You do not need to. Your code comes printed on the card. If the card is damaged or the digits are unreadable, your issuer mails a replacement, and many banks show the code inside their mobile app.
Why was my card declined when I typed the CVV right?
A CVV match is one check among many. A billing address mismatch, a blocked merchant category, or a fraud rule on your account can decline the charge even when the code is correct.
Do virtual cards work for subscriptions?
Only if the number is merchant-locked rather than single-use. A single-use number fails on the second billing cycle. Read the terms before you move a recurring charge to one.
What should I do if someone offers to sell me CVV data?
Walk away and report it. The FBI's Internet Crime Complaint Center takes public reports, and your card issuer wants the tip. Sending money to that seller often ends with an empty account and a police report.
How do I stop my own CVV from leaking?
Shop on sites with a padlock and a known checkout provider, avoid saving cards in browsers on shared devices, and check your statement each week. If a charge looks wrong, call the issuer and ask for a new card number.
The Short Version
A CVV is not merchandise. It is a three- or four-digit proof code tied to one card and one account, and it stays with the cardholder. If you need a number you can hand out online, ask your bank about virtual cards, use a prepaid card, or set spending alerts on the card you already have.