What a CVV dump is
A CVV dump is a bundle of stolen card records sold in bulk, and each record carries the card number, the expiration date, and the CVV or CVC verification code. Sellers often add the cardholder name, billing ZIP, and issuing bank. The word "dump" is old fraud slang from the magnetic stripe era, when stolen track data was dumped off a card. Today it mostly describes card-not-present data, the kind used on websites rather than swiped at a register.
You will not find one on a bank site. A dump is a black market file, usually a plain text list or a spreadsheet, traded in forums, messaging channels, and automated shops. Prices per record are low, often a dollar or two, because volume is the business model and because plenty of cards in any batch are already dead.
Dump, fullz, and a single card number
People mix these up, and the difference tells you how the data will be used.
- Card number only: the 16 digit PAN by itself. Weak, since most checkouts ask for more.
- CVV dump: PAN, expiration, and CVV, sometimes with name and ZIP. Enough for a card-not-present purchase at a merchant with loose verification.
- Fullz: everything above plus SSN, date of birth, address, and sometimes account logins. Used to open accounts, not just buy things.
Where the data comes from
- Physical skimmers on ATMs, gas pumps, and self-checkout lanes that copy the stripe.
- E-skimming, also called Magecart, where an injected script reads the checkout form as the customer types.
- Merchant and processor breaches, including point-of-sale malware that scoops card data out of memory.
- Phishing, fake support calls, and BIN attacks that guess valid numbers in bulk against a weak payment form.
Why the CVV is the part that matters
The CVV exists to prove the physical card is present. It is not printed on receipts, and it is not supposed to be stored anywhere after a transaction is authorized. That is the whole point of it. When a merchant keeps verification codes in a database, a breach converts a pile of useless card numbers into ready-to-use dumps. This is why PCI DSS classifies the code as sensitive authentication data and forbids retaining it post-authorization.
Best CVV Dump Sites: A Merchant Security Comparison
For the buyer, a dump is a race. There is a short window before the cardholder notices or the bank kills the card. That urgency is why dump fraud shows up as a small test charge first, then a burst of orders for goods that resell fast.
If you shop online, what helps
- Use a virtual card number or a wallet like Apple Pay or Google Pay. Tokenization means the real PAN never reaches the merchant.
- Turn on transaction alerts in your banking app. Fast notice is the main defense, since the window is short.
- Think twice about saving a card at a small or unfamiliar shop. A stored card is a stored target.
- Read statements line by line. Charges under a few dollars are the classic probe before a bigger hit.
If you run a store
- Never store the CVV. Not in logs, not in a CRM, not in a support ticket.
- Tokenize so your own systems never hold a usable PAN.
- Add step-up authentication such as 3-D Secure on high-risk orders.
- Watch the checkout page for injected scripts, and control third-party tags with a content security policy and subresource integrity.
- Look for card testing patterns: many small orders, sequential numbers, mismatched billing data, rapid retries from one IP range.
The legal side
Buying, selling, or possessing stolen card data is a federal crime in the United States under 18 U.S.C. 1029, and penalties climb with the number of cards involved. There is no legal version of this market. If your own card turns up in a dump, freeze it, dispute anything unfamiliar, set alerts, and file a report with the FTC and the FBI's Internet Crime Complaint Center.