Do not buy CVV online. Every seller you meet is either a scammer, an undercover agent, or a criminal who keeps buyer logs. A successful transaction leaves you in possession of stolen payment card data, which is a federal crime in the United States.
What "buy CVV online" means in the carding economy
A CVV is the three digit code printed on a payment card. Online merchants need the card number, expiration date, and cardholder name, not only the code. A shop that promises CVV sells a "card" or a "fullz" package: the complete payment record of a real person that came from a breach, a skimmer, or a phishing page.
These stolen records change hands on Telegram channels, dark web forums, and invite-only shops. Sellers describe their stock with tags like "fresh," "validated," and "high balance." None of those tags tell you whether the original card owner has already reported the fraud, because most have.
How a CVV purchase really plays out
You find a shop link in a Telegram group. The vendor asks you to create a Bitcoin wallet and send a deposit before you can view any card list. Once you deposit, the site shows you a stock page that lets you filter cards by country, bank, and issuing range.
- You deposit between $20 and $100 in Bitcoin.
- You select a card file and pay the quoted price.
- The shop sends a text list with card numbers, expiration dates, and CVV codes.
- You try to use one card in a checkout form.
- The bank declines the transaction and places a fraud hold on the account.
At step four, the card-issuing bank sees a purchase from an unknown device in an unknown location. That pattern triggers an anti-fraud alert, and the card is canceled. The shop then calls the file "dead" and refuses to give your deposit back.
What sellers actually mean when they promise "fresh" or "fullz"
"Fresh" means the card number was stolen recently. Issuers often notice abnormal spending on a newly dumped number within hours. "Validated" means the seller already ran a tiny test purchase to confirm the card works, which burns the card and creates a fraud record at the merchant bank.
"Fullz" packages go beyond the card and include the holder's name, address, Social Security number, and date of birth. Buying a fullz is not just credit card fraud; it is identity theft. Aggravated identity theft under 18 U.S.C. 1028A adds two years in federal prison on top of any other sentence.
Current price ranges on carding shops
Published dark web price indexes show a typical single US card selling for $10 to $30. Prices climb past $100 for a "high balance" card that comes with a checking account or login access. Bulk files with thousands of dead records drop to under a dollar per card.
Whichever price band you look at, the cost is fake. PrivacyAffairs reports that most listed cards are sold months after the breach source stops being useful. The card networks and issuing banks participate in a global fraud alert system, so a card that works for one trial purchase usually stops working for the second.
When the CVV shop is run by law enforcement
The US Secret Service, FBI, and international agencies operate fake carding stores to identify buyers and sellers. After a successful seizure, the site often shows a banner with an official emblem and a message that all user accounts, IP addresses, and balances have been preserved. Notifications like that appeared after the FBI took down the carding platform Dark Market and after Operation Cardinator in Europe.
A police-run shop delivers the same product as a criminal shop: card numbers that came from actual victims. The difference is that the vendor computer logs your activity in real time. When agents close the store, they close on you.
Pitfalls that catch buyers before any card works
Scam vendors collect Bitcoin deposits and log off for good. Their storefronts reopen the next week under a new name with the same stolen cards. You cannot ask for a refund through customer service without identifying yourself, and the "support" person is often an agent building a file.
Bitcoin is not anonymous. Every payment sits on a permanent public ledger, and blockchain analysis firms sell tracing services to federal investigators. When you buy Bitcoin on a regulated exchange with your ID and then send it to the shop wallet, that is a direct link.
Can you buy CVV online and get away with it? The FAQ
Is buying CVV online a felony in the US?
Yes. Using a stolen card number violates 18 U.S.C. 1029, access device fraud, which carries up to 10 years in prison for a first offense. Repeat offenders face up to 20 years, plus fines that can reach $250,000.
Can I test a CVV with a small purchase to see if it works?
No. That action is called card testing, and merchants report it to the card networks as suspected fraud. The test payment leaves a timestamp, an IP address, and a merchant record that investigators can subpoena.
Do CVV shops offer refunds for dead cards?
They offer replacements, not refunds. The replacement card is simply another victim's number that has not yet been reported. That makes the original purchase even harder to explain in court.
What should I do if I already tried to buy CVV online?
Stop using the card data and stop contacting the vendor. Save the messages and receipts, then contact a criminal defense lawyer before you speak with anyone else. If law enforcement contacts you first, tell the agent you want legal counsel and say nothing else.