"Selling CVV to carding shops" describes the trade in stolen card verification values, the three- or four-digit codes printed on a payment card. Criminals harvest that data and sell it in bulk to carding shops, which use it to place fraudulent orders online. It is a crime in every U.S. jurisdiction, and the buyers and sellers are both exposed to prosecution. The useful question for a shopper or a merchant is not how the trade works in detail but why online checkout is the target and what closes the gap.
What the phrase actually covers
A CVV is not a password and it was never meant to be a secret shared between parties. It exists to prove the person typing the card number is holding the physical card. When that code leaks alongside the card number, expiration date, and cardholder name, a criminal has what the industry calls a fullz record: enough data to attempt a card-not-present transaction.
CVV Shop Reseller Options: A Comprehensive Guide
Carding shops are the resale layer. They list batches of stolen records, often sorted by card brand, issuing bank, or billing country. The listings are frequently fake or recycled, which is a detail worth knowing because it explains why so much of that market is noisy and short-lived. The operators churn domains and identities constantly to stay ahead of takedowns.
How the data gets out
- Skimming and shimming at fuel pumps, ATMs, and unattended terminals.
- Phishing and smishing pages that mimic a bank or a delivery notice and ask for card details.
- Merchant breaches where payment data was captured in transit or at rest without proper controls.
- Malware on consumer devices that scrapes checkout forms as they are filled in.
Most of these paths are old and well documented. What changes is the packaging. A text message that looks like a toll bill is the same play as a fake bank email from a decade ago, just with better timing.
Sending CVV to Shops for Payment: A Buying Guide
Why online checkout is the soft spot
In a store, the card is present and gets authenticated by chip or tap. Online, the merchant sees data, not a card. That is the whole vulnerability. Card-not-present fraud has consistently been the growth area in payment crime precisely because the merchant cannot inspect the plastic.
Regulation helps here. PCI DSS forbids retaining the CVV after authorization, so a compliant merchant should never have that code sitting in a database for an attacker to lift. If a breach exposes CVVs, something in the handling chain was already broken.
What actually blocks the trade
Tokenization replaces the real card number with a surrogate that is useless outside its intended context. EMV 3-D Secure adds a risk check at the issuer during checkout, so a stolen record alone is often not enough to complete an order. Address verification and velocity checks catch the mismatch between a billing address and a shipping destination that shows up in so many fraudulent orders.
For consumers, the practical habits are unglamorous. Use a virtual card number for unfamiliar sites, keep a separate card for subscriptions, and turn on transaction alerts so an unauthorized charge surfaces in minutes rather than at the statement. Report fraud to the issuer immediately and file a complaint with the FTC; the liability rules favor people who move fast.
If your card data surfaces in a shop
Assume the number is burned. Request a replacement card rather than waiting for a fraudulent charge to appear, and change any password reused on shopping accounts. Watch for order confirmations you did not place, since criminals often test a card with a small purchase before a large one.
The trade in stolen CVVs persists because the data is cheap to move and the buyers are anonymous. It shrinks when the data stops being useful at checkout, and that is a design problem merchants and issuers can solve.