No legitimate shop pays for a CVV. A message that offers money for a card security code is a fraud offer. There is no payout. The card gets charged, or the code gets resold, and the person who sent it takes the loss.
What a CVV is
A CVV is the 3 or 4 digit code printed on a payment card. Visa calls it CVV2. Mastercard calls it CVC2. American Express calls it CID. The code sits off the magnetic stripe and off the chip. It exists to prove that the person typing the card number holds the physical card.
Card networks and the PCI Security Standards Council bar merchants from storing the code after a transaction is authorized. That rule is the reason a real shop never needs a CVV sent by chat, email, or text.
What the offer looks like
The pitch arrives in a chat app, a forum, or a direct message. The sender claims to run a shop, a cashout service, or a buyer network. The sequence repeats.
- The sender asks for a card number, an expiration date, and a CVV.
- The sender promises a percentage of a purchase or a flat fee.
- The card is charged. The charge can clear in minutes.
- The promised payment does not arrive. The messages stop.
Some versions skip the card use. The shop collects codes from many people, then sells the batch to a third party. The people who sent codes become witnesses in a fraud case, not partners in a business.
Why the payment never comes
Money pulled from a stolen card is traceable. A buyer has no reason to pay a stranger who can report the scheme. In many cases the person who asked for the CVV is the person who uses it.
Legal exposure
Using another person's card data is card-not-present fraud. Selling card data is trafficking in stolen financial records. Keeping a share of the proceeds can be charged as money laundering. Federal law in the US treats access device fraud as a felony. Banks close accounts tied to the transfers and file reports on them.
If you sent a CVV
Call the card issuer and ask for a freeze and a new card number. Check statements for charges you do not recognize. Report the message to the Federal Trade Commission and to the FBI Internet Crime Complaint Center. Under US law, credit card holders owe no more than $50 for unauthorized charges. Debit card liability depends on how fast the loss is reported.
If you get the message
- Do not reply. Do not send a code, a card photo, or a one-time passcode.
- Block the account and keep the message as evidence.
- Report the account to the platform and to the FTC.
How to keep a CVV private
- Type the code inside a checkout page on a site you trust.
- No merchant asks for a CVV by email, chat, or a phone call you did not start.
- Use a virtual card number for a first purchase at an unknown store.
- Turn on transaction alerts for every charge above a set amount.
- Freeze the card in the bank app when a code has been shared.