What a low price on a CVV actually signals
Search that phrase and you land in forum threads and Telegram channels offering card numbers for the price of a coffee. Both facts hold at once: the listings are real, and almost every claim attached to them is false. This is written for the cardholder whose CVV ends up in one of those dumps, and for anyone who saw a $3 price tag and did not think it through.
Selling CVVs on the Dark Web: Why 'No Scam' Offers Are Always Fraud
Start with the economics. A stolen card with the CVV attached sells for a few dollars, maybe ten or thirty if the issuing bank verifies poorly. That number is not a bargain. It tells you the supply is industrial. Skimmers bolted onto gas pumps, injected scripts on checkout pages, phishing kits sold by subscription, breached merchant databases. All of it produces card data by the thousand, and the seller prices it to move before the bank shuts the accounts down.
The labels sellers use, and why none of them can be trusted
Listings repeat the same vocabulary. It exists to make an unverifiable product feel measurable.
- BIN. The first six or eight digits, which identify the bank and card type. Buyers filter on it to find issuers with weak fraud controls.
- AVS status. A claim about whether the billing address on file will match what the buyer supplies at checkout.
- 3DS or VBV. Whether the card triggers a one-time code. Cards without that step get priced higher.
- Fullz. Card data bundled with name, address, and government identifiers. That package is built for identity takeover, not a single purchase.
- Valid rate. A percentage the seller invents. Nobody issuing refunds on dead cards stays in business long.
The pitfalls, roughly in the order they bite
- Exit scams. The shop takes payment, credits the account, and closes the domain within days. Rebranding is cheap. Reputation is the product being sold, and it is fabricated.
- Malware in the tooling. The checkers and browsers handed out with a membership often carry their own payload. The buyer becomes the next victim, crypto wallet and saved logins included.
- Dead cards. Banks kill cards fast once a fraud pattern shows up. A dump bought on Monday can be worthless by Wednesday, and the shelf life shrinks every year.
- Criminal exposure. In the United States, trafficking in card credentials falls under federal fraud statutes with prison terms, not fines. A cheap card is a felony that costs three dollars.
- Your own data as collateral. Signing up hands a stranger your email, wallet address, and often an identity document. That file gets resold whether or not the card works.
Keeping your CVV out of the pile
Card data leaks through predictable doors. Closing them is more useful than watching the market.
- Never read the three-digit code aloud on an inbound call. Banks do not ask for it. Neither does any legitimate support desk.
- Use virtual or single-merchant card numbers where your issuer offers them. A number that exists for one store is worthless in a dump.
- Turn on transaction alerts and approve purchases in the bank app. A one-time code stops most card-not-present fraud cold.
- Skip saving cards in browsers and random shopping apps. Every stored profile is one breach away from a dump.
- Check the checkout page before typing. A padlock alone proves little if the domain is a lookalike.
If your number is already circulating
Act on the assumption that the card is burned. Freeze it in the bank app, then call and ask for a new number rather than a reissued card on the same digits. Dispute charges in writing and keep the confirmation. If your name, address, or identifiers went out with the card, place a freeze with all three credit bureaus and file a report at IdentityTheft.gov. Report the marketplace itself to the IC3 so the pattern gets logged.
One last thing about price. When stolen card data costs less than lunch, the sellers are not offering a deal. They are telling you how much of it they have, and how little your card means to them.