The honest answer first
There is no lawful retail market for CVV numbers. The CVV, that three-digit code on the back of a Visa or Mastercard, exists for one reason: to prove the person typing it is holding the physical card. Split the code from the card and it stops being a security feature. Any site selling "fresh CVVs" is selling a story, not a product. That is the part most people learn after they send the money.
Buying CVV Online: A Comprehensive Buying Guide
I have read enough of these listings to notice the pattern. They promise live cards, they take payment in crypto or gift cards, they hand over a batch file, and within hours the numbers stop working because the real cardholder reported the charge. Or nothing arrives at all. Either way the buyer has no recourse, because the transaction itself is illegal in every U.S. state and under federal law.
What people searching this usually want
Most of the searches behind this keyword are not from career fraudsters. They come from people who want one of four things, and all four have a legal version.
- A card number that is not tied to their main bank account. Ask your bank for a virtual card number, or use a prepaid card bought at a pharmacy. Both give you a real CVV that actually authorizes.
- Protection from a merchant they do not trust. Single-use virtual numbers from your issuer expire after one charge. That is the feature, not a bug.
- A way to pay on sites that blocked their card. This is usually a billing address mismatch, not a card problem. Fix the address, not the card.
- Something that sounds cheap. A $20 "fullz" or "CVV pack" is cheap because it is worthless or stolen. Legitimate virtual cards are free or a couple of dollars a month.
Parameters worth checking on any card product
If the goal is safer online spending, grade the product on these, not on price per number.
- Issuer backing. A card from a chartered bank or credit union carries dispute rights. A card from an anonymous seller carries none.
- Dynamic CVV. Some business and premium cards rotate the code every few minutes. If a merchant stores the code, it goes stale.
- Spend limits and merchant locks. You want to set a per-transaction cap and, where possible, restrict the number to one merchant.
- Billing address control. The declared billing address must match what you entered with the issuer, or the authorization fails and you blame the card.
- 3-D Secure support. One-time passcodes to your phone add a layer that a stolen number cannot clear.
- Chargeback path. Ask what happens when a merchant ships nothing. If there is no bank behind the card, the answer is nothing.
Pitfalls that cost real money
The obvious pitfall is paying a stranger and getting a dead number. The less obvious one is what you inherit. Using a card number that belongs to someone else is identity theft and access device fraud, and the federal sentencing guidelines do not care that you only tested it. Banks and card networks run velocity checks on CVV attempts, so a handful of failed codes from your IP is enough to flag the account, the device, and sometimes your own bank relationship.
Then there is the resale loop. Many of these "shops" are run by the same people laundering payments, gathering buyer details, and later using that contact information for extortion. You are not a customer to them. You are inventory.
A smaller trap: buying a legitimate-looking "CVV" service that is actually a subscription you cannot cancel. Read the terms, look for a physical business address, and check whether the company appears in any regulator action.
What to do instead
Open your banking app and search for virtual cards. Most major U.S. issuers now offer them at no cost, generate a number in seconds, and let you freeze it with one tap. If your bank does not, a prepaid card from a grocery store counter works for almost any online checkout. That route gets you a working CVV, a real dispute process, and a clean conscience.
If you have already sent money to a CVV seller, treat it as a fraud loss: contact your payment provider, report it, and change any password or email you shared with them.