No. Buying a CVV from a shop means buying stolen payment card data, and in the United States that is a federal crime under 18 U.S.C. § 1029. The websites and chat channels that sell CVVs are criminal marketplaces, and the money you send funds carding operations. No legal version of this market exists.
What Is a CVV, and What Does a "CVV Shop" Sell?
A CVV (also called a CVC or card security code) is the three-digit number on the back of most Visa, Mastercard, and Discover cards, or the four-digit number on the front of an American Express card. It exists to prove that the person typing the card number has the physical card in hand.
How to Buy CVV from a Reliable Shop: A Comprehensive Guide
A CVV shop is a storefront that sells that data in bulk. Listings bundle the card number, expiration date, security code, cardholder name, and billing address into a single record.
- Card only: number, expiry, and CVV with no personal details attached.
- Fullz: card data plus name, address, phone, and sometimes a Social Security number.
- Dumps: data copied from a card's magnetic stripe or chip, used to make cloned cards.
Sellers move this inventory through dark web forums, automated bots, and encrypted messaging apps. Buyers use the data to order goods, buy gift cards, or resell the numbers to someone else. Every one of those steps is a crime.
Is Buying a CVV From a Shop Illegal in the US?
Yes. Federal law criminalizes the whole chain. Under 18 U.S.C. § 1029, producing, selling, or possessing stolen access devices (card numbers count) carries fines and prison time that can reach 10 years for a first offense. Wire fraud charges under 18 U.S.C. § 1343 and aggravated identity theft under 18 U.S.C. § 1028A stack on top in many cases.
State prosecutors add their own charges for larceny, forgery, and identity theft. Card networks pursue civil claims, and merchants can sue for chargeback losses.
People assume that buying one card number without a big spending spree is a minor matter. Courts treat it as felony conduct.
Why Do People Search for CVV Shops?
Three groups show up in these searches, and they face very different outcomes.
- People who want to commit carding fraud. This group is the customer base the shops are built for.
- Scam victims in waiting. Many shops are fake. They take payment in crypto, deliver nothing, and keep a record of the buyer, which can be used for blackmail later.
- Researchers, journalists, and fraud analysts. Security teams study these markets to find stolen card data that belongs to their own customers.
If you fall in the third group, work through your legal or security team and do not transact. A purchase is the crime, and a research excuse does not erase it.
Who Pays the Price for Stolen CVVs?
Cardholders spend hours on the phone, wait for a replacement card, and sometimes lose access to funds while a dispute runs. Merchants absorb chargebacks, fraud fees, and higher processing rates. Banks reissue cards and staff fraud teams to handle the volume.
Card testing is a related problem. Fraudsters run thousands of small charges to check which stolen numbers still work. Those micro-charges land on real statements and generate customer service calls that merchants pay for.
How Cardholders Can Protect Their CVV
- Never read your CVV to a caller who contacts you first. Banks and real merchants do not ask for it that way.
- Skip photos of your card. Images stored in phone galleries, email, or cloud backups are a common leak path.
- Use virtual card numbers from your issuer for subscriptions and one-off purchases.
- Turn on transaction alerts for every charge above a small threshold.
- Check your statement each month and report charges you do not recognize to your issuer.
- Inspect card readers at gas pumps and ATMs before you swipe or insert.
How Merchants Cut Card-Not-Present Fraud
Requiring the CVV at checkout is the first step. The code proves the buyer holds the card, and under most card network rules a merchant that collects and validates it shifts fraud liability to the issuer for that transaction.
Layer other checks on top:
- Address Verification Service (AVS) matching on billing street and ZIP.
- 3D Secure authentication, which sends a challenge to the cardholder's bank.
- Velocity limits on how many orders one IP, device, or card can place in a short window.
- Manual review of orders that ship to an address different from the billing address.
PCI DSS also forbids storing the CVV or CVC after a transaction is authorized. Keeping the code in a database, even encrypted, is a compliance violation.
What to Do If You Already Bought a CVV
Stop using the data and stop buying more. Each transaction adds evidence, and prosecutors build cases from chat logs, crypto ledgers, and shipping records.
Talk to a criminal defense lawyer before you talk to anyone else. If a seller scammed you, you cannot report that loss without admitting the underlying attempt, so let a lawyer handle that decision.
If your own card data was stolen, call your issuer to freeze the card, place a fraud alert with the credit bureaus, and file a report with the FTC's identity theft reporting site and the FBI's Internet Crime Complaint Center.
FAQ
Is buying a CVV legal anywhere?
Card data belongs to the cardholder. Buying it without that person's consent is theft or fraud in every US state and in most countries. Some jurisdictions treat the buyer as a co-conspirator in the theft itself.
Are CVV shops real?
Some are, and many are not. Fake shops outnumber working ones, and offers of a "free test card" or demands for odd payment methods are signs of a con aimed at the buyer rather than the cardholder.
Can someone use my card with only the CVV?
No. The security code does nothing without the card number and expiration date. Online checkout needs the full set, which is why complete records sell for more than partial ones.
What is the difference between a dump and a fullz record?
A dump is data read from a card's stripe or chip and is used to create a physical clone. A fullz record is a text bundle of card details plus personal identity data. Both are stolen records sold on the same markets.
Where do I report a CVV shop?
Send the details to the FBI's Internet Crime Complaint Center and to the fraud team at the card issuer whose cards are listed. Banks route those reports to their own investigators and to law enforcement.
Key Takeaways
- Buying a CVV from a shop is a federal felony in the US, not a gray area.
- The market runs on stolen data, and many sellers are scammers who target buyers.
- Cardholders should guard the CVV, use virtual numbers, and review statements each month.
- Merchants should require the CVV, use AVS and 3D Secure, and never store the code after authorization.