Short answer first
A "CVV shop" is a storefront that trades stolen card numbers. When someone says they want to sell a CVV, they mean selling another person's card data, and that is card fraud in every U.S. state and under federal law. There is no licensed version of it, no gray market, no legitimate reseller program. The people who reliably make money in that economy are the ones running the shop and the ones reselling the same stolen numbers to five different buyers. If you are here because you want to keep your own card safe while shopping online, the rest of this page is written for you.
What the CVV actually is
The CVV, also printed as CVC or CVV2, is the three digit code on the back of most cards, or four digits on the front for American Express. It is not a password and it is not a second card number. It exists to prove that whoever is typing the card number is holding the physical card. That single purpose is why card networks forbid merchants from storing it after a transaction is authorized. If a site saves your CVV in a database, that site is out of compliance regardless of how big or trusted the brand looks.
I look for the code the same way everyone else does, but I treat it as the one piece of card data that should never sit anywhere except a payment form. No email, no chat message, no phone call, no note in my phone.
How stolen CVVs end up for sale
Card data reaches those shops through a small number of repeat paths:
- Skimmers and shimmers placed on gas pumps and ATMs, which capture the magnetic stripe and sometimes the keypad entry.
- Phishing pages that copy a bank or retailer login and harvest saved card details.
- Malicious scripts injected into real checkout pages, which quietly copy form fields as shoppers type them.
- Merchant database breaches where card data was stored when it should not have been.
Sellers bundle these into lots, sometimes with names, addresses and dates of birth attached. A large share of what gets listed has already been sold, canceled, or flagged by the issuing bank. Buyers in that market routinely pay for data that stopped working weeks earlier.
Why it is a bad trade on both sides
On the selling side, trafficking in account credentials and access devices is a federal offense, and prosecutions usually bundle wire fraud and identity theft charges on top. On the buying side, the buyer has no recourse. There is no chargeback process for a stolen card number that does not work, no support channel, and no way to complain without describing a crime. I have watched people treat these shops like a normal ecommerce category. They are not. They are run by people who already know how to separate a stranger from their money.
Keeping your CVV out of those listings
- Use virtual or single-use card numbers for unfamiliar sites. Many issuers offer them in the banking app.
- Pay with a wallet that tokenizes the card, so the merchant never sees the real number or the code.
- Check that the checkout page is served over HTTPS and that the address bar shows the domain you expect, not a lookalike.
- Never read the code out to someone who calls you. Banks do not ask for it, and neither does a real fraud team.
- Skip "save my card" on small sites. Convenience is not worth a stored credential on a shop with one part time developer.
- Read your statement line by line once a month. Small test charges are how card data gets validated before the big purchase.
If your card data shows up for sale
Call the number on the back of your card and ask for the card to be closed and reissued. Then pull your credit reports and look for accounts you did not open. File a report with the FTC and a complaint with the FBI's Internet Crime Complaint Center, which is how patterns across victims get connected. Keep the confirmation numbers. If a merchant charged you for something you never bought, dispute it in writing within the window your issuer allows.
If you run an online store
Never store the CVV. Use hosted payment fields or a tokenization setup so the code passes straight to your processor and never touches your servers. Scope your PCI DSS obligations honestly, patch the checkout code, and review third party scripts on your payment page every time marketing adds one. Card testing attacks hit small merchants first because they are the easiest to probe.