Short answer
A search for a site that will sell CVV for carding returns criminal marketplaces, not shops. A CVV is the 3-digit code printed on the back of most Visa, Mastercard, and Discover cards and the 4-digit code on the front of American Express cards. Sellers on those sites trade the code together with the card number, expiry date, cardholder name, and billing address. Buyers use the set to order goods that ship to a drop address. The trade is access device fraud under 18 U.S.C. § 1029. There is no legal version of it.
Why the term shows up in search results
Carding forums copy retail language. Listings use words like shop, stock, and refund. Some pages hold nothing but a payment form and a chat handle. Others are phishing traps that take a payment and send no data. Both kinds sit on domains that rotate every few weeks after takedowns or blocklist entries.
How the data gets taken
- Skimmers on fuel pumps, ATMs, and transit kiosks.
- Malware on point-of-sale terminals and ecommerce checkout scripts.
- Phishing pages that clone a bank login or a store payment page.
- Breaches at merchants, processors, and hotels.
- Social engineering calls that ask a cardholder to read a code from a text message.
What the law says
18 U.S.C. § 1029 sets up to 10 years in prison for a first trafficking offense and up to 15 years for a second, plus fines. 18 U.S.C. § 1343 covers wire fraud and carries up to 20 years. Prosecutors charge operators, resellers, and buyers. The Department of Justice has run takedowns against carding markets, and the FBI lists card fraud among its cyber priorities.
Protection for cardholders
- Turn on purchase alerts in the bank app. Set the threshold at one dollar.
- Freeze the card from the app when it is not in use.
- Use single-use virtual numbers for online checkout.
- Keep the CVV out of email, chat, and notes apps.
- Read the statement each month and dispute unknown charges in writing.
- Report identity theft at IdentityTheft.gov and file a complaint with the FBI IC3.
Protection for merchants
- Require the CVV at checkout and decline mismatches.
- Run AVS checks on the billing address and ZIP code.
- Tokenize card data so the number never sits in a database.
- Apply PCI DSS 4.0 controls to the checkout page and payment scripts.
- Enable 3-D Secure for high-risk orders.
If a card number leaks
Call the issuer. Ask for a new number and a new CVV. The old code stays valid on some recurring billing until the number changes. Watch for test charges under two dollars. A small charge from an unknown merchant often comes before a large one.