The short answer
No legitimate shop sells CVV data. The three or four digit code printed on a card exists for one purpose: to prove the person paying is physically holding that card. A CVV shop is a storefront for stolen card numbers, and the trade around it, usually called carding, is a felony in the United States and most other countries. If you found this page while trying to protect your own card, skip ahead to the section on locking down your code. If you came here to buy or sell, understand that these investigations are routine and the participants tend to get caught in bunches.
What a "CVV shop" actually is
The term describes an automated website, often reachable only through special software, that dumps batches of card data for sale. Buyers pay in cryptocurrency and receive card numbers, expiration dates, names, and sometimes the CVV. Sellers get that data from skimmers on gas pumps and ATMs, from breached retailer databases, from phishing pages, and from malware that scrapes checkout forms. None of it was given willingly by the cardholder.
Prices are low for a reason. A single card record often sells for the price of a fast food meal, and most of those records are dead on arrival because the bank already froze the account or the cardholder reported the charge. The sellers do not offer refunds. The buyers absorb the loss, along with the criminal exposure.
Where the risk lands
- Buyers: Using a stolen card number is access device fraud under 18 U.S.C. 1029. Federal prosecutors bring these cases regularly, and cooperation from payment processors makes identification easier than people assume.
- Sellers: Trafficking in card data carries heavier penalties, plus money laundering charges when crypto moves through mixers.
- Cardholders: You usually owe nothing for fraudulent charges, but the cleanup takes time, and repeated hits can follow you across new accounts.
I have watched enough breach notification letters pile up to know the cardholder is rarely the one who pays the money. The cardholder pays in hours on hold and in the nagging worry that the next statement will have another surprise.
How I protect my own CVV
These habits cost nothing and close most of the common attack paths.
- Use a virtual card number for online subscriptions. Most major issuers generate one that is tied to your real account but expires or locks after a single merchant.
- Never read your CVV aloud on a call you did not initiate. Banks do not ask for it. Scammers do.
- Check the card slot and keypad before you swipe or insert at a pump. A loose faceplate or an odd overlay is a skimmer.
- Turn on transaction alerts for every charge over a small threshold. You will spot a test charge before the big one lands.
- Keep one card for online use and a different one for in-person spending, so a single compromise does not touch everything.
If your card data turns up somewhere
Freeze the card in your banking app the moment something looks wrong. Then call the number on the back of the card, not a number from an email or text. Dispute the charges in writing if the bank asks for it, and request a new card number rather than a replacement with the same digits. Change the password on any shopping account that stored the card, and turn on two-factor authentication there. Finally, pull your free credit reports and look for accounts you did not open. Card fraud and identity theft often travel together.
The honest takeaway is that there is no shop worth finding on either side of this. The only CVV that matters to you is the one on your own card, and keeping it private is a few settings and a couple of habits away.