Short answer

There is no legal place to buy a CVV. The three or four digit code printed on a payment card is a security value tied to one card and one account. It is not a product, a license, or a subscription. Sites and chat channels that advertise CVV sales move stolen card numbers, or take payment and send nothing. Both outcomes cost the buyer money and both carry legal risk. Card networks and issuers classify the sale of card data as fraud.

What the code is for

Visa prints CVV2. Mastercard prints CVC2. American Express prints CID. The value sits on the back of most cards and on the front for American Express. A merchant asks for it at checkout to show the buyer holds the physical card. Card networks forbid merchants from storing the code after a transaction is authorized. PCI DSS Requirement 3.2 covers this. A code offered for sale is either stolen or invented.

Check the seller before you enter card data

  • Confirm the checkout page uses HTTPS and shows a valid certificate for the exact domain.
  • Look for a posted refund policy, a physical business address, and a working contact method.
  • Check whether the site asks for a card verification code at all. A site that skips it may be harvesting numbers.
  • Prefer merchants that support 3-D Secure or an app-based approval step. The extra step shifts chargeback risk to the issuer.
  • Use a virtual card number or a payment token from your issuer for unfamiliar sites. The token maps to your account and expires.

Parameters that matter at checkout

  1. Billing address match. A mismatch triggers a decline or a manual review.
  2. CVV length. Visa and Mastercard use three digits. American Express uses four.
  3. Amount and currency. Confirm the total after tax and shipping before you approve.
  4. Recurring billing. Note any pre-checked subscription box.
  5. Statement descriptor. Save the merchant name shown on the receipt for dispute filing.

Pitfalls

  • Sellers who request payment in gift cards, crypto, or peer-to-peer transfers. These channels have no chargeback path.
  • Listings that bundle card data with names, addresses, and dates of birth. The bundle is identity theft material and a felony to possess.
  • Escrow offers from the same party that runs the sale. The escrow is part of the scheme.
  • Screenshots of card images as proof. Images prove nothing and can expose the buyer to extortion.

If your own card data leaks

The Fair Credit Billing Act caps cardholder liability at $50 for unauthorized charges, and many issuers waive it. Call the number on the back of the card, ask for the card to be closed, and request a new number. Review charges for 60 days. File a report at IdentityTheft.gov and a complaint with the FBI Internet Crime Complaint Center if a vendor took payment and delivered nothing.