Short answer
There is no legal market for CVV numbers in the United States. A CVV or CVC is a 3-digit or 4-digit code printed on a payment card. The code shows that the person placing an online order has the physical card in hand. Listings that offer to sell CVV data with no minimum order are selling stolen card numbers. Buying or selling them is a federal crime under 18 U.S.C. 1029.
What the digits on your card do
Visa, Mastercard, and Discover print a 3-digit code on the back of the card. American Express prints a 4-digit code on the front. Each network uses its own name for the field: CVV2, CVC2, CID, Card Identification Number. Merchants do not store it after the sale, and PCI DSS rules bar them from keeping it.
A card number alone is weak proof of identity. Account numbers come from database breaches, skimmers, and phishing pages, and parts of them can be guessed. The code cannot be derived from the account number. That is why a merchant that asks for it blocks a large share of card-not-present fraud.
Why online stores ask for the code
In a card-present sale the terminal reads the chip. In a card-not-present sale the merchant has only the fields on a form. The code is one of the few items that ties the order to the card itself. When the check runs and the merchant follows network rules, part of the fraud liability moves to the issuer.
Why "no minimum" listings appear
Card data moves in bulk on criminal forums and chat apps. Sellers add "no minimum" to draw buyers who want one or two numbers instead of a batch of hundreds. The supply comes from breaches, gas pump skimmers, and fake checkout pages.
Federal law covers the whole chain. 18 U.S.C. 1029 bans the sale, transfer, and possession of access devices with intent to defraud. A first conviction carries up to 10 years in prison, plus fines and restitution. Buyers get no protection. Sellers take payment in cryptocurrency or gift cards, then disappear.
Red flags in a card-data offer
- A price per number or per batch
- Payment by cryptocurrency, gift card, or wire transfer
- Claims that numbers are "fresh" or "with balance"
- No business name, address, or refund term
- Pressure to act in minutes
How to keep a CVV safe
- Use a virtual card number for subscriptions and one-off sites.
- Keep the card in view at a terminal, and cover the keypad.
- Turn on transaction alerts in the card app.
- Check the statement each week, not each month.
- Do not send card data through text, email, or chat.
- Close cards you no longer use.
If your card number leaks
Call the issuer and ask for a new card and a new number. Review statements for 12 months. Report the fraud to the FTC at IdentityTheft.gov. If the loss is large, file a complaint with the FBI's Internet Crime Complaint Center. Keep copies of every report. Under the Fair Credit Billing Act, your liability for unauthorized credit card charges stops at $50, and most issuers waive that.
What "no minimum" does not change
Order size has no effect on the law. One number or one thousand numbers, the act is the same. It also has no effect on risk. Buyers who pay for card data have no way to check the source and no recourse when the numbers fail. Sellers face charges, forfeiture, and a permanent record.