What the search "want to buy cvv" covers
The CVV is the 3-digit security code printed on the back of Visa, Mastercard, and Discover cards. American Express prints a 4-digit code on the front. The code confirms that the card is in hand during a card-not-present purchase. It ships with the card. There is no separate CVV item to purchase.
Two groups run this search. The first group is shoppers who reached a checkout page and found a field marked CVV or CVC. The second group is looking for stolen card data. This page serves the first group and states the law for the second.
CVV/CVC Security for Online Purchases: A Buyer's Guide
Card data is not a retail product
Card numbers and CVVs belong to the issuing bank and the cardholder. No bank, card network, or merchant sells them. A listing that offers "CVV" for sale is a sale of stolen access devices.
US federal law covers this under 18 U.S.C. § 1029, fraud in connection with access devices. Selling, buying, or holding card data with intent to defraud is a federal felony. Prison terms reach 15 years. Card network rules add chargeback liability and account termination on top of the criminal exposure.
The PCI Data Security Standard forbids merchants and processors from storing the CVV after an authorization. Any vendor that claims to hold a database of live CVVs is either breaking that rule or lying about the inventory.
Legal ways to get a card number for a purchase
- Prepaid cards. Sold at grocery stores and pharmacies. Load a set amount. No credit check.
- Virtual card numbers. Many US issuers generate a one-time or merchant-locked number inside the banking app. The number carries its own CVV and expires after use.
- Gift cards. Closed-loop cards carry a code on the back. Some work for online orders.
- Debit cards tied to a checking account. Standard issue from any US bank.
Each route gives you a number that the issuer will honor. None require a third party seller.
Pitfalls when a seller offers card data
- Most listings are scams. The buyer sends payment and receives a dead number or nothing.
- Some listings are run by law enforcement as part of a sting operation.
- Card data sold in bulk is often already flagged by the issuer and blocked at authorization.
- Buyers who use the data face charges under § 1029 and civil suits from the issuing bank.
- Payment for the data leaves a transaction record tied to your identity.
Checks before you type a CVV at checkout
- Confirm the site uses HTTPS and shows a valid certificate for the exact domain.
- Read the refund and shipping terms. A site with no address and no return policy is a risk.
- Use a virtual card number for first-time merchants. Set a spending cap.
- Never send a CVV by email, chat, or text. No legitimate merchant asks for it outside a payment form.
- Watch for forms that request the CVV plus a photo of the card. That combination has no valid use.
If your CVV was exposed
Call the number on the back of your card and ask for a replacement. The issuer cancels the old number and issues a new CVV. Review recent charges line by line. Report unauthorized charges in writing within the window set by your card agreement, which is 60 days for most US consumer cards under Regulation Z. File a report at IdentityTheft.gov if your identity data was also exposed.
Related terms
CVV, CVC, and CID name the same field on different networks. CVV2 and CVC2 refer to the second-generation code used in card-not-present transactions. The code is not the PIN. The PIN authorizes ATM and debit transactions and never appears on the card.