The short answer
There is no legitimate marketplace where CVV or CVC numbers are bought and sold. The three digit code on a card is issued to one person and one account, and every site advertising fresh CVV, fullz, or bulk card data is either reselling stolen records or charging you for data that does not exist. In the United States, buying that data is a federal offense under 18 U.S.C. 1029, and the buyer is the easiest person in the chain for investigators to identify, because the transaction leaves a payment trail, a login, and a device fingerprint. If you came here to make a purchase, the useful takeaway is the reverse of one: the numbers in those listings are the same ones that appear later as fraudulent charges on ordinary statements, so the practical work is protecting the cards you already hold and the checkout you already run.
What a CVV shop actually is
Automated storefronts that claim to sell card data run on the same infrastructure as carding forums. A breach dump or a botnet produces a batch of account numbers, the operator lists them by bank identification number and country, and buyers pay in cryptocurrency. Three things hold true for almost all of them. The data is usually dead, meaning the card was canceled or drained before the listing went up. The shop keeps a record of every buyer, which converts a purchase into evidence. And the operators frequently run the fraud themselves, using the storefront to harvest payment and identity details from people who cannot report a loss without admitting to a crime.
Signs your own card is being used this way
- A burst of small charges under a dollar, often from streaming, gaming, or ride share merchants, which is how thieves verify that a number is live before a larger purchase.
- Declines on your own card while your balance looks normal, a common result of a test charge resetting the issuer risk score.
- Password reset emails you did not request, which usually mean a credential list is being checked against your accounts.
- A replacement card arriving without a request from you, which can mean someone changed the mailing address on file.
How merchants shut the pattern down
Card testing is cheap to run and expensive to absorb, because every declined attempt still costs an authorization fee and every approved one becomes a chargeback. The defense is a stack of small controls rather than one gate.
Parameter bands that work
- Require the CVV for every card not present authorization and decline automatically on a mismatch. Do not route mismatches to review unless the order value is high enough to justify manual work.
- Match address verification on street number and ZIP. A full mismatch belongs in decline territory; a ZIP only match can go to review.
- Apply 3-D Secure above a defined order value band, commonly starting somewhere between 100 and 250 dollars, and keep the exemption list short.
- Rate limit by IP and device fingerprint. More than three to five declines within ten minutes from one source should trigger a temporary block.
- Cap the number of distinct card numbers a single account or session may attempt in a day. Legitimate shoppers rarely use more than two.
Pitfalls
- Storing the CVV after authorization. PCI DSS does not permit it, and a database of security codes is the most valuable file an attacker can find on your server.
- Treating a CVV match as proof of identity. The code proves possession of card data, not that the person typing it owns the account.
- Relying on a single signal. Fraud rings rotate IP addresses and card numbers, so velocity checks and device reputation carry more weight than any one field.
- Assuming a small test charge is harmless. It is the first step in a chain that ends with a large order and a dispute.
FAQ
Can CVV data be bought legally anywhere?
No. There is no licensed broker, reseller, or exchange for card security codes. Any offer to sell them describes stolen property or a scam.
Does buying one card make it a crime?
Yes. Federal law covers trafficking in, and possession of, unauthorized access devices, and quantity is a sentencing factor rather than a threshold for liability.
What should I do if I see a charge I did not make?
Contact the issuer using the number on the back of the card, dispute the charge in writing within the window your card agreement sets, and request a new number. Keep records of every call.
Do CVV checker tools work?
They are the fraud itself. The tool sends authorization attempts against a list of numbers, which is why using one exposes your own payment details and location to whoever operates it.