Do sites that sell CVV numbers online actually work?
No. Sites that sell CVV numbers trade in stolen payment data, so every listing is a crime rather than a product. In the United States, trafficking card numbers falls under 18 U.S.C. § 1029, with prison terms that reach 10 years for a first offense. A review of those marketplaces is a review of card fraud, so the useful advice points the other way: avoid them and protect your own CVV.
The CVV (card verification value, also called CVC or CVV2) is the 3 digit code on the back of most cards, or 4 digits on the front of American Express cards. The code exists to prove the physical card is in hand during a card-not-present purchase. That single design detail is why stolen card data hunts for it.
Why CVV shops fail the people who use them
Forums and chat channels that sell card numbers run on scams inside scams. Sellers dump dead cards, buyers phish each other, and admin accounts vanish with the deposits. Payment happens in crypto, so there is no chargeback and no recourse when a deal goes bad.
- Card numbers go stale in hours. A bank blocks a compromised card as soon as a fraud model flags it.
- Buyers get phished by fake escrow services that copy the shop's own layout.
- Law enforcement watches these marketplaces. The FBI's Internet Crime Complaint Center tracks carding reports and seizes servers.
- A "working" card still draws a chargeback, which the merchant disputes and reverses.
- Card networks push new rules that force extra verification on risky checkouts, which kills the resale value of a dumped number.
Best pick for CVV protection: virtual card numbers
Virtual card numbers beat every other option for online shopping. Your issuer generates a disposable number tied to your real account, with its own CVV and expiry date. If a merchant leaks that number, you close it in one tap and your real card stays clean.
- Cost: several large US banks include virtual cards at no extra charge. Check your issuer's app before you pay a third party.
- Setup: minutes, inside the banking app you already use.
- Coverage: works at most online checkouts that accept your card brand.
- Control: set a spending cap, keep one number per merchant, or burn the number after a single charge.
How the other CVV protection options compare
Single-use virtual cards
Some providers offer a burner mode that closes the number after one charge. This is the safest setup for a purchase from a shop you have never used, and it costs nothing beyond the card you already hold. The tradeoff is friction: you generate a new number for each order and lose the saved card at checkout.
Merchant tokenization
Apple Pay, Google Pay, and network tokens swap your card number for a token, so the merchant never sees the CVV. Adoption is broad at large retailers and thin at small ones. You also cannot see or manage the token the way you manage a virtual card, which makes troubleshooting harder.
Card freeze and transaction alerts
Every major US issuer lets you lock a card in the app and receive a text for each charge. Both features are free and take seconds to switch on. They are reactive, though: the freeze happens after you spot the charge, and it does not stop a number a merchant already stored.
Credit monitoring and card insurance
Monitoring services watch your credit reports for new accounts opened in your name. That helps after a breach and does little as prevention, and paid tiers run $10 to $30 per month. Federal law already gives you free weekly reports through AnnualCreditReport.com, so pay for monitoring only if you want alerts and identity restoration staff.
How to spot a CVV-selling scam site
These marketplaces repeat the same tells. None of them appear on a bank site, a card network, or a security vendor.
- Claims of "fresh" or "high balance" card data with a guarantee of validity.
- Crypto-only payment and no dispute path.
- Reviews written by the same accounts that moderate the forum.
- Captcha gates and Tor-only mirrors, which hide the operators rather than protect users.
- Refund policies that require you to buy more data before you can file a claim.
What to do if your CVV ends up for sale
- Freeze the card in your issuer's app, or call the number on the back of the card.
- Ask for a new card number and confirm that the old number is closed for good.
- Change passwords on shopping accounts and switch on two-factor authentication.
- Pull your credit reports and dispute any account you do not recognize.
- File a report at IdentityTheft.gov and send a card fraud complaint to the FTC.
Act on the same day. A card number plus CVV pair has a short shelf life, and the charges usually land within hours of the leak.
Frequently asked questions
Is buying a CVV online legal?
No. The card number belongs to the account holder and the issuing bank. Buying one counts as unauthorized access device trafficking under federal law, and using it adds wire fraud and identity theft charges.
Can a CVV be reused across sites?
Yes, and that repeat use is the core problem. A card number and CVV pair works at any merchant that skips extra verification, so one leak can fund dozens of purchases. Virtual cards break the link by handing each merchant a different number.
Are any CVV-selling sites legitimate businesses?
No. Payment processors, gift card resellers, and prepaid issuers sell payment products of their own. None of them sell another person's card verification value, and none of them can, because they do not hold it.
Does a VPN or antivirus protect my CVV?
In part. They lower the odds that malware or a fake checkout page captures the number as you type it. They do nothing once a merchant database leaks, which is why virtual cards and tokenization matter more for online purchases.
Do merchants store my CVV after checkout?
PCI rules bar merchants from storing the CVV after a transaction is authorized. Card numbers, names, and expiry dates can be stored, and that is the data that shows up on a carding forum when a shop gets breached.
The verdict
Skip the marketplaces. There is no version of a CVV shop that serves a buyer, and the legal risk lands on anyone who touches the data. For your own protection, a virtual card number is the first pick, single-use burners cover unfamiliar shops, and tokenization plus a card freeze fill the gaps at no cost.