The short answer
Any offer to sell CVV numbers immediately is a fraud scheme. There is no legitimate wholesale market for card verification values, and the seller is either moving stolen card data or planning to take your money and vanish. If you run an online store, the purchase worth evaluating is card verification and fraud protection for your own checkout. Judge those tools on how little card data they force you to hold and how well they separate real customers from stolen-card traffic, not on how many acronyms appear on the pricing page.
What to look for in CVV and card verification protection
The strongest products remove the verification value from your systems instead of storing it. Look for these capabilities when you compare processors and fraud vendors.
- Hosted payment fields or iframes, so the CVV is captured in the processor environment and never passes through your servers.
- Network tokenization and stored credential support, so repeat billing uses a token in place of the card and the verification value.
- Written confirmation that sensitive authentication data is not retained after authorization, which is what PCI DSS requires.
- A rule engine that reads AVS and CVV response codes together and routes mismatches to decline or manual review.
- Velocity controls per card, device, IP address, email, and shipping address.
- Step-up authentication such as 3-D Secure, with the option to request it only for risky orders.
- Role-based access and audit logs, so no support agent can view a full card number or verification value.
- Dispute and chargeback reporting built in, with alerts before you cross a network monitoring threshold.
Parameter bands to use when you configure checks
Exact numbers depend on your industry, average order value, and processor, but the ranges below are reasonable starting points for a card-not-present store.
- CVV attempts: allow one to three tries per card per checkout, then block the card and flag the account for a day.
- CVV mismatch handling: decline a mismatch on high-risk or high-value orders, and send a mismatch on low-value orders with a matching AVS to review rather than auto-decline.
- Approval rate: domestic card-not-present stores often see approvals in the low to mid 90 percent range. A drop of several points in a week points to a configuration or routing problem.
- Dispute rate: keep disputes far below one percent of transactions. Visa and Mastercard monitoring programs have used thresholds near 0.65 percent and one percent, and those figures change, so confirm the current program guide.
- Manual review load: hold review to a small share of orders. A queue that swallows a large slice of traffic stops being a control and becomes a bottleneck.
- Frictionless authentication: aim for most low-risk orders to pass without a challenge while high-risk orders get stepped up.
Pitfalls that cost merchants money
- Storing CVV anywhere after authorization, including a CRM note, an order comment, or a spreadsheet. This breaks PCI DSS and turns a small breach into a large one.
- Buying a 'CVV checker,' 'BIN validator,' or card testing service. Those tools exist to test stolen cards, and using them exposes you to criminal liability.
- Recording support calls without pausing the recording while the customer reads the verification value.
- Treating a BIN lookup, a phone number match, or an email check as card verification. None of them prove the buyer holds the card.
- Ignoring account takeover. A stored card on file plus a weak login is a gift to a fraud ring, because some repeat billing flows skip the CVV.
- Skipping re-verification when a customer updates a card or changes a shipping address on an established account.
FAQ
Is it legal to buy or sell CVV numbers?
No. Card verification values belong to the cardholder and the issuing bank. Trading them is trafficking in stolen payment credentials, and it is a crime in the United States and most other countries.
What should I do if someone offers to sell me CVV data?
Do not send money and do not engage further. Save the messages and report the offer to the platform where it appeared and to law enforcement, including the FBI Internet Crime Complaint Center.
Do I have to collect the CVV on every online order?
Card networks and processors support card-not-present transactions with or without the verification value, but collecting it and never storing it is the stronger posture. It shifts liability in some dispute cases and raises the cost of using a stolen card number.
Can I keep CVV on file for subscriptions?
No. Sensitive authentication data cannot be retained after authorization. Use network tokens or the stored credential frameworks offered by the card networks for recurring billing instead.
My card number was used without my permission. Now what?
Call the number on the back of your card, ask for the card to be replaced, and review recent statements for charges you do not recognize. Report confirmed fraud to the FTC and to your local police if the amount is significant.