If you run into an offer to sell CVV data, treat it as evidence of card fraud, not as a product you can buy. The three or four digit code printed on a payment card is a security credential. No bank, payment processor, or merchant has a legitimate reason to trade it. There is no safe purchase to make from that kind of listing. What you can control is your own checkout hygiene as a shopper, and the way you handle card verification data if you run a store. Everything below covers both sides: how to spot the scam, and what a defensible online payment flow looks like.
What a sell CVV offer actually is
The term describes trade in stolen card numbers paired with their verification codes, often bundled with name, address, and expiration data. These listings surface on dark web forums, in messaging app groups, and sometimes in spam email or social media comments. The cardholder whose data is for sale did not authorize the transaction. Buying from such a seller can expose you to criminal liability for trafficking in compromised payment credentials, and it also puts you in a market where the counterparty is a thief by definition. Chargebacks, account shutdowns, and law enforcement interest follow the money, not just the seller.
Legitimate vendors of anything, from clothing to software, never sell verification codes as a standalone item. If a listing advertises codes alone, or advertises codes at a discount because they are "fresh" or "checked," the only product on offer is stolen data.
What to look for before you enter your code anywhere
- The checkout page uses HTTPS and the address bar shows a valid certificate for the merchant's own domain, not a lookalike spelling.
- The site asks for the code only at the moment of payment, never in a chat window, support ticket, or email reply.
- A card network logo, a recognizable payment processor, or a hosted payment page appears as the party collecting the data.
- The merchant offers electronic receipts with a clear business name, address, and cancellation terms.
- Your card issuer or the merchant app can send a real-time approval prompt for the transaction.
Parameter bands that separate a solid payment flow from a risky one
- Transport security: TLS 1.2 at minimum, with TLS 1.3 preferred for any page that accepts payment data.
- Storage of the verification code: zero. PCI DSS prohibits retaining sensitive authentication data after the authorization is complete, and this applies to paper, logs, databases, and backups.
- Authentication step-up: 3D Secure or an equivalent challenge for high-risk orders, new devices, or carts above a threshold you set.
- Dispute ratio: card networks start monitoring merchants when chargebacks approach roughly 1 percent of transactions, so keep a buffer well under that line.
- Tokenization: replacing the card number with a token at the point of capture, so future charges never touch the raw number.
- Access control: role-based permissions and logging for anyone who can view order records, with the code field masked or absent entirely.
Pitfalls that catch both shoppers and merchants
- Answering a "verification" message that asks you to confirm your code to a stranger. Banks do not ask for it that way.
- Storing codes in spreadsheets, help desk notes, or a customer relationship management system for convenience.
- Reusing one card across unfamiliar sites that each promise a discount for saving the full number and code.
- Clicking through from an unsolicited message to a checkout page that was not typed or bookmarked by you.
- Assuming a card-present chip or tap payment protects a card-not-present order. Online transactions rely on different controls.
- Ignoring small unauthorized charges. Test charges of a dollar or two often precede larger fraud.
FAQ
Is selling CVV data legal anywhere?
No. Trading compromised payment credentials is a crime in the United States and in every jurisdiction with card fraud statutes. There is no licensed marketplace for it.
What happens if someone buys one of these listings?
They are dealing with criminals. The data may be stale, the seller may resell the same record several times, and the funds sent are rarely recoverable. Legal exposure is separate from the financial loss.
Does requiring the code stop fraud?
It helps for card-not-present transactions because the code is not printed on the magnetic stripe, but it is one layer. Tokenization, authentication challenges, and address verification carry weight too.
Should a merchant ever store the code?
No. Keep it out of databases, logs, and backups. If your team needs to verify a payment, work from the authorization response instead of the code itself.
How do I report a sell CVV listing?
Report it to your card issuer, to the FTC, and to the FBI Internet Crime Complaint Center. If you are a merchant and your own checkout was compromised, notify your payment processor and acquiring bank right away.