What Is a CVV Dump?
A CVV dump is a set of stolen card records sold in criminal marketplaces, where each record carries a card number, an expiry date, and the cardholder name, plus the CVV or CVC security code when the seller claims to have it. The wording comes from carding forums, not from banks or payment networks. No legitimate seller offers such data, and buying or using it is card fraud.
"CVV" means the card verification value printed on the plastic, and "dump" means a bulk file of records. Sellers trade these files in batches and advertise them by brand, country, and BIN range.
CVV Dump Format and Track Data: What the Terms Actually Mean
What Data Sits Inside a Dump?
Record layouts differ by seller, but most listings carry a small set of fields. The exact contents matter less than the source: any file like this comes from a breach, a skimmer, or a phished checkout page.
- Primary account number (the 16-digit card number)
- Expiry date
- Cardholder name and, in some listings, billing address
- CVV2, CVC2, or CID code, when the seller claims to have it
- Magnetic stripe track data in older dumps made by skimming devices
Some sellers add Social Security numbers, dates of birth, and account logins, then label the bundle "fullz." That term covers identity data, not card codes.
Where Dump Data Comes From
Three sources feed these files: merchant database breaches, skimming hardware on gas pumps and ATMs, and fake checkout pages that capture what a shopper types. Each leaves a different trace, which is why fraud teams look at the source before they judge a batch.
Breach data explains most of the card numbers in circulation. It explains far fewer working codes, since card networks bar merchants from keeping the CVV after a purchase clears.
Why the CVV Field Decides Whether a Dump Works
The CVV is a check value the issuer generates from the card number and its own secret keys. A merchant that requires the code gets a yes or no answer during authorization, and nobody can derive the code from the card number alone.
Dumps sold without a valid code fail that check. It is one reason fraud rings pay more for records that include a working code, and one reason many listings overstate what they hold.
PCI DSS Requirement 3.2 bars merchants from storing the code after authorization, so a breach of a retailer's database does not hand over CVV data. Records with a live code most often come from skimmers or phishing pages that grab the code as the cardholder types it.
Why Most Dump Transactions Fail at Checkout
- Card reissued after a breach, so the number is dead
- 3-D Secure step-up asking for a one-time passcode sent to the cardholder's phone
- Address Verification Service mismatch on billing street number and ZIP
- Velocity and device rules that flag a new device plus a high-value cart
- BIN and geo checks that block cards from a region the merchant does not serve
Each control adds a separate failure point. A seller's screenshot of a successful order proves little, since fraud rings test cards on weak sites and resell the same file to many buyers.
Is Buying or Using a CVV Dump Legal?
No. In the US, using someone else's card data without permission falls under access device fraud and identity theft statutes, including 18 U.S.C. § 1029. Holding a bulk file of card numbers with intent to use them is enough for charges in many cases.
Buyers face risk beyond arrest. The markets are run by criminals, escrow seldom works, and files get resold to many people. Nothing in the deal is enforceable.
How Cardholders Keep the Code Private
- Type the code only on a checkout page you reached by entering the merchant's address yourself
- Never send the code by email, chat, or text, and treat any request for it as a red flag
- Use virtual or single-use card numbers from your issuer on unfamiliar sites
- Review statements each week and report charges you do not recognize at once
- Request a new card and number if a merchant you used reports a breach
Visa, Mastercard, and American Express all publish zero liability policies for unauthorized charges, so a cardholder who reports fast seldom pays. The report itself starts the reissue process and kills the old number.
How Merchants Block Dump-Based Orders
- Require the CVV on every card-not-present order and never store it
- Run AVS checks and reject mismatches on high-value carts
- Turn on 3-D Secure for risky transactions or regions
- Set velocity caps per card, device, IP, and email domain
- Tokenize card data so your systems hold no raw numbers
These steps push fraud cost onto the attacker. Most dump-based attempts then move to softer targets, which is the point of the controls.
Common Questions
Is a CVV dump the same as a fullz?
No. A dump centers on card data, while a fullz bundle adds identity fields such as a Social Security number, date of birth, and account logins. Both are criminal products.
Can a CVV be guessed?
No practical method exists. The issuer derives the code from keys tied to the card, and a three-digit code leaves 1,000 combinations, with retry limits at any real merchant.
Why do some dumps list a CVV but still fail?
Sellers reuse old screenshots, mix stale records into new files, and pad batches to look bigger. A code that worked on a weak test site often fails at a merchant running 3-D Secure and AVS.
What should I do if my card data shows up in a dump?
Call the issuer, close the card, and dispute any charge you do not recognize. Then change passwords on shopping accounts and check statements for a few months.
Key Points
- A CVV dump is stolen card data sold in bulk, not a product any bank or processor issues.
- The CVV is the field that decides if a record works, and PCI rules keep merchants from storing it.
- Cardholders stay safe by keeping the code off email and chat and reporting odd charges at once.