No legitimate shop purchases CVVs. Any site advertising that it buys or sells card verification values is a criminal carding marketplace, and using one exposes you to felony fraud charges, malware infection, and payment loss with no dispute channel or refund.
What does "shops that purchase CVV" actually mean?
The phrase describes carding forums and dark web storefronts that traffic in stolen card data, including the three or four digit security code printed on a payment card. These are not payment processors, data brokers, or fraud research firms. Every record listed on such a site belongs to a real cardholder who did not consent to the sale.
Searches for this term usually come from two groups: people trying to commit fraud, and people who encountered the phrase and want to understand the risk. The guidance below serves the second group.
Is buying or selling a CVV legal in the United States?
No. Trafficking in stolen card credentials falls under 18 U.S.C. § 1029, which prohibits the sale, transfer, and possession of unauthorized access devices. Penalties include statutory fines and prison terms of up to 10 to 15 years for aggravated cases, even when the buyer never completes a single transaction.
Selling your own card number to a third party also breaks your cardholder agreement and typically voids fraud protection on that account. Issuers treat voluntary disclosure as cardholder negligence.
Why do these sites still show up in search results?
Carding operators use throwaway domains, cloaking, and spam indexing to appear for security-related keywords. Pages often vanish within days or weeks when the host or registrar takes them down. A stable search ranking is not evidence that a marketplace is real or safe.
What are the practical risks of visiting a CVV marketplace?
- Malware and session theft: many storefronts load scripts that harvest browser cookies, saved passwords, and crypto wallet keys.
- Advance-fee scams: the most common outcome is paying in cryptocurrency and receiving nothing.
- Credential capture: anything you type, including your own card details, is logged and resold.
- Law enforcement visibility: carding infrastructure is routinely monitored, and visitor traffic is part of the record.
- Account takeover: a compromised browser session can expose email, banking, and shopping accounts within hours.
How do you tell a carding marketplace from a legitimate payment service?
- Legitimate processors never ask for a CVV by email, chat, or phone.
- No lawful business buys raw card numbers from consumers.
- Regulated merchants settle through an acquiring bank, not crypto-only payment pages.
- Real services publish a registered entity name, terms of service, and a dispute process.
- Prices listed per card record, or bulk "dumps" sold by BIN, are a definitive red flag.
How do you protect your own CVV when shopping online?
- Enter the security code only on a checkout page you reached directly, never through a link in an unsolicited message.
- Use virtual or single-use card numbers from your issuer for unfamiliar merchants.
- Prefer tokenized wallets such as Apple Pay or Google Pay, which do not transmit the real code.
- Turn on real-time transaction alerts so an unexpected charge reaches you in seconds.
- Skip saving card details in browsers on shared or work devices.
What should you do if your card details were exposed?
Call the number on the back of your card immediately and ask for a block and replacement. Review at least 12 months of statements for small test charges, which fraudsters use to validate a card before a large purchase. Report identity theft at IdentityTheft.gov and file a complaint with the FBI's Internet Crime Complaint Center, then run a full malware scan on any device used at the suspected site.
Frequently asked questions
Do any legitimate shops buy CVVs from consumers?
No. Card networks prohibit merchants and processors from storing or trading the CVV after authorization, so no compliant business has a reason to purchase one. Any offer to buy is a fraud scheme by definition.
Can I sell my own CVV?
No. Even for your own card, disclosing the security code to a third party breaches your issuer agreement and removes your fraud liability protection. In practice, buyers use the data for charges you will spend weeks reversing.
Are CVV sites safe if they have good reviews?
Reviews on these platforms are written by the operators and their affiliates. There is no independent arbitration, escrow, or consumer protection in an illegal marketplace, so reputation signals carry no meaning.
Why do payment forms ask for a CVV at all?
The code proves the buyer physically holds the card, which reduces card-not-present fraud. It is designed to be entered once during checkout and never stored afterward by a compliant merchant.