You cannot legally buy a CVV anywhere. A card verification value is generated by the bank or card network that issued the card, and it is never sold as a standalone product to consumers or merchants. Every site, bot, or seller advertising "CVV for sale" is trading in stolen card data, running an advance-fee scam, or both, and buying from them is a federal crime in the United States.
What a CVV actually is
The three- or four-digit code on your card is a cryptographic check value tied to the account number and expiry date. It exists so a merchant can prove the person checking out physically holds the card. Because it is derived from data the issuer controls, there is no inventory of CVVs that anyone could resell.
Why "CVV shops" are always a dead end
Sellers on forums and Telegram channels claim to offer "fresh" or "high-balance" codes at a few dollars each. The economics give the game away: a working code is worth far more to a criminal than the asking price, so anything cheap is either a scam or already burned.
- You lose the money. Payment is requested in crypto or gift cards, with no recourse and no delivery.
- You inherit the evidence. Chat logs, wallet addresses, and order records become evidence in a carding investigation.
- You become the mark. Many "vendors" harvest buyer identities for later extortion or account takeover.
How to get a valid CVV the legitimate way
- Open a card with a regulated bank or credit union, which mails or displays the code in its own app.
- Request a virtual card from your existing issuer when you need a disposable code for a one-off purchase.
- Use a network-branded prepaid card bought from a mainstream retailer, where the code is printed under the scratch panel.
All three routes give you a code the issuer will actually authorize. None of them involve a third-party marketplace.
How to judge a checkout that asks for your CVV
A legitimate merchant collects the code only at the moment of authorization. Judge the page on four parameters:
- PCI DSS compliance. Look for a published attestation of compliance or a listed payment processor.
- 3-D Secure prompts. A real issuer step-up redirects you to your bank's domain, not to the shop.
- Field behavior. The code field should be masked, never pre-filled, and never saved to an account profile.
- Transport security. The checkout must be HTTPS with a certificate matching the merchant's own domain.
Red flags of a fraudulent CVV seller
Watch for escrow claims with no verifiable operator, screenshots of "balance checks," bulk discounts, and pressure to pay within minutes. Any of these is a scam signal rather than a product feature. Sites that promise refunds for dead codes are describing a black market, not a consumer protection policy.
What to do if you already paid a CVV seller
Stop all contact, preserve the transaction records, and report the loss to the FBI's Internet Crime Complaint Center and the FTC. If you shared your own card details, call the issuer immediately and request a replacement number. Never send a second payment to "unlock" a first order.
Is buying a CVV illegal in the US?
Yes. Purchasing card data you are not authorized to use falls under federal fraud and identity theft statutes, and possession with intent to use is enough for charges. The legal exposure does not depend on whether the code works.
Can a merchant store my CVV for later charges?
No. PCI DSS prohibits storing the verification value after authorization in any form, including encrypted. If a site offers to keep your code "on file" for convenience, treat that as a serious security failure and shop elsewhere.