The short answer
There is no legitimate market that sells CVVs for bitcoin. The phrase describes carding, the criminal trade in stolen card numbers and their verification codes, conducted on hidden forums and paid in cryptocurrency to obscure the money trail. No bank, payment processor, or merchant sells CVV data. A site or seller that offers to is either committing payment fraud or running a scam against the buyer. Either way, the money is gone and the activity is a federal crime in the United States.
Selling CVV Online Is Card Fraud: A Security Guide
What a CVV actually is
The card verification value is the three digit code on the back of most cards, or the four digit code on the front of an American Express card. It is printed, never embossed, and it is not stored in the magnetic stripe or the chip. Its only job is to prove the person entering the number is holding the physical card. Because of that, the Payment Card Industry Data Security Standard forbids merchants from storing the CVV after a transaction is authorized. A database of CVVs for sale is, by definition, a database of stolen data.
How the fraud economy is structured
Card data moves through a chain: skimmers and phishing pages capture numbers, brokers bundle them, and resellers market them on invite only forums. Bitcoin and similar coins are used because transfers settle without a bank in the middle. The buyer usually receives nothing usable. Card issuers block flagged numbers fast, and forum sellers routinely take payment and disappear. The people who profit most are the ones selling the data, not the ones buying it.
Warning signs a checkout page is harvesting your card
- The page asks for the CVV twice or asks you to email it.
- The site has no published privacy policy, address, or phone number.
- Your browser shows no padlock, or shows a certificate warning you clicked past.
- A pop up offers an unusual discount in exchange for card details sent by message.
- The URL is a misspelling of a brand you recognize.
Steps to protect your own CVV
- Enter the code only on a checkout page you reached by typing the merchant address yourself.
- Check that the address bar shows the full domain and a valid certificate before you type anything.
- Use a virtual or single use card number from your issuer for unfamiliar merchants.
- Keep the card in a sleeve that blocks scanning when it is in your pocket or bag.
- Never read the code aloud on a call you did not initiate, and never send it by text or email.
- Turn on transaction alerts so a charge you did not make reaches you within minutes.
Steps for merchants and site owners
- Route every card entry field to a PCI validated payment processor so the CVV never touches your server.
- Remove the CVV from order confirmation emails, support tickets, and internal notes.
- Set your processor to require CVV and address verification on every card not present transaction.
- Log and review failed CVV attempts by IP address to catch card testing bursts.
- Patch your checkout platform and any plugins on the vendor's release schedule.
If your card data is exposed
- Call the number on the back of your card and ask the issuer to block the card and issue a new number.
- Review statements for small test charges, which often precede a larger fraudulent purchase.
- Dispute any charge you did not authorize in writing with the issuer.
- Change passwords on shopping accounts that stored the card, and enable two factor authentication.
- File a report at IdentityTheft.gov and keep the confirmation number with your dispute records.
The bottom line
Selling card verification codes is fraud, not commerce. Treat any offer to buy or sell CVVs for bitcoin as a crime in progress. The useful defense is boring: keep the code off paper and out of messages, buy from merchants you can verify, and act the same day a charge looks wrong.