What the phrase refers to
A CVV is the 3-digit code printed on the back of most Visa and Mastercard cards, and the 4-digit code on the front of American Express cards. The code proves the person holding the card number also holds the physical card.
Listings that offer to sell CVV data are offers to sell card numbers that belong to someone else. The cardholder did not authorize the sale. In the US, trafficking in access devices falls under 18 U.S.C. 1029. Buying that data falls under the same statute as selling it.
Signals that a cheap listing ends in a loss
- Price far below the card balance. Bulk data gets resold many times.
- No BIN, no issuing bank, no expiration date.
- Seller asks for crypto or gift cards, with no dispute path.
- The same card data appears in more than one listing.
- The site collects your details first and delivers nothing.
How CVV verification works on the merchant side
Merchants run three checks on a card-not-present order. Address Verification Service compares the billing address to the issuer record. CVV verification compares the code to the issuer record. 3-D Secure adds a bank challenge step. A CVV mismatch returns a decline from the issuer, and the merchant eats the chargeback when the order ships anyway.
PCI DSS forbids storing the CVV after authorization. A merchant that asks you to send the code by email or chat is out of compliance, and the request is a red flag.
Protecting your own card
- Never read the CVV in an email, chat, or inbound phone call.
- Use a virtual card number on sites you have not bought from before.
- Read the statement each month and dispute unknown charges.
- Report card fraud to the issuer and to the FTC.
- Freeze the card in the bank app when it is not in use.
Pitfalls in the buying process
- A screenshot of a card is not proof the card works.
- A small "verification" charge to your own card is a common pretext in scams.
- Sellers who move the deal to a private chat avoid platform records.
- Data sold as fresh is often months old and already flagged.