The buying advice first
There is no legitimate shop that sells CVVs. A CVV or CVC is the three or four digit code printed on a payment card and bound to that specific card and account. It is not a product with a supply chain, and no bank, processor, or card network licenses anyone to resell codes in bulk. Every site advertising "fresh CVVs," "fullz," or a "99% valid rate" is fencing stolen payment credentials. In the United States, buying one falls under 18 U.S.C. 1029, which covers trafficking in unauthorized access devices and carries penalties that reach 10 years for a first offense and 15 for aggravated cases, before state charges or identity theft counts are added.
Buying CVV Websites: A No-Scam Buying Guide
That leaves the real question behind the search: how do you pay online without handing your own code to the wrong party, and how do you confirm that a merchant you buy from handles your CVV correctly? That is what the rest of this guide covers. If the goal is to pay with someone else's card data, the answer is no, and the exposure is legal rather than technical.
What the CVV actually does at checkout
The code is a check value that shows the person typing the card number has the physical card or the issuer's wallet token. Visa, Mastercard, and Discover print three digits on the back. American Express prints four on the front and calls it the CID. The merchant sends the code to the issuer during authorization, and the issuer replies with a match, no match, or not processed. A mismatch is one of the strongest fraud signals in card-not-present transactions, which is why card testing attacks probe it first.
PCI DSS Requirement 3.2 forbids storing sensitive authentication data, including the CVV, after authorization, even in encrypted form. A merchant that keeps your code is out of compliance and becomes a breach target. The same rule explains why a well-built checkout asks for your CVV on every order instead of remembering it.
What to look for when you evaluate a seller
Signals that a checkout is sound
- Payment fields sit on the merchant's own domain or a recognized processor's hosted page, not on an embedded form owned by a third party.
- The page collects card number, expiry, CVV, and billing address together. Splitting those across email or chat is a warning sign.
- 3-D Secure or a biometric prompt appears on higher-risk orders. Frictionless approval is normal, and so is a challenge on an unusual order.
- Address verification is in use. You are asked for the ZIP tied to the card's billing address, not the shipping destination.
- Guest checkout exists and does not require your card code to be saved to an account.
Signals that a CVV shop is a scam or a trap
- Escrow, "verified vendor" badges, and review threads. Those build trust inside a criminal market where no one can enforce a dispute.
- Volume pricing and inventory sorted by bank or country. That is a wholesale fraud catalog, not a payment service.
- Free test cards or a checker tool. Using one means running an authorization you are not authorized to run.
- Contact only through Telegram, Discord, or a throwaway mailbox. No regulated payment company operates this way.
Parameter bands that matter
- Code length: 3 digits for Visa, Mastercard, Discover, and most co-brands; 4 digits for American Express. Anything else is a typo or a fake.
- Card number length: 15 digits for Amex, 16 for most others, 19 for some co-brands. A 16-digit number presented as Amex will fail authorization.
- Storage window: zero. Post-authorization retention of the CVV is prohibited by PCI DSS, so any promise to "keep it on file" is a compliance problem.
- Dispute window: under the Fair Credit Billing Act and Regulation Z you have 60 days from the statement date to dispute a billing error, and network chargeback rules generally allow up to 120 days from processing for fraud claims.
- Liability cap: $50 for a lost or stolen card number reported promptly under federal law, and often $0 under network zero-liability policies.
Pitfalls that cost people money
Buying "valid" data. Card data sold in bulk is often already burned, meaning the issuer has closed the account, or it is synthetic. The buyer loses the purchase price and gains a record of intent.
Card testing. Small trial charges to see whether a number works are exactly the pattern issuer fraud models watch for. Merchants log IP, device, and velocity data, and processors report the pattern.
Handing your own CVV to a person. If a seller asks for your code over chat, email, or a phone recording, they plan to store it. That is a PCI violation and a common step toward card-not-present fraud on your account.
Phishing pages that ask for everything at once. Card number, CVV, one-time passcode, and your password on a single screen is not how a bank or processor collects data. The passcode request is the tell.
Storing the code yourself. Screenshots, notes apps, and password managers with a card field are all breach surfaces. Use your issuer's virtual card feature when you want a number you can rotate.
FAQ
Is there any legit CVV shop?
No. Payment networks do not license resale of card verification values. Sites that advertise this trade stolen credentials, and buying or selling falls under federal access device statutes.
How do I get a card number I can use online without exposing my real account?
Use a virtual card number from your issuer or a tokenized wallet. These generate a separate number and code bound to your account, can be capped or set to single use, and can be deleted without replacing your physical card.
Why does a store ask for my CVV every time I buy?
Because it is not allowed to store it. Re-entering the code confirms the card is present and keeps the merchant inside PCI DSS Requirement 3.2.
What happens if someone uses my CVV?
Report it to your issuer at once, then file an FTC identity theft report if accounts were opened in your name. Your liability is capped at $50 when you report promptly, and most networks waive it outright.
Does the CVV protect me if a merchant is breached?
Partly. The code cannot be stored after authorization, so a compliant merchant's breach exposes card numbers and expiry, not the CVV. That limits the damage but does not remove it, which is why virtual numbers are worth the extra step.