There is no legitimate place to buy a CVV. The CVV or CVC is the three or four digit security code printed on a payment card, and it is issued only by the bank or card network that issued that card. Sites, forums, and chat channels that advertise CVV sales are dealing in stolen card data, which is illegal in the United States and usually ends with the buyer losing money rather than receiving a working code.
What a CVV is and who can issue one
The card security code is generated by the issuer and tied to a specific card number and expiration date. It is a fraud-control feature, not a product. It has no wholesale price, no distributor, and no resale market that a bank participates in.
- Issuer: your bank or credit union, or the card network's issuing partner.
- Function: proves the person entering the number physically holds the card, which is why card-not-present merchants ask for it.
- Storage rule: merchants that accept cards are not allowed to keep the code after the transaction authorizes, so a legitimate business should never be able to sell one to you later.
Legitimate ways to get a CVV for your own online purchases
If your actual goal is to pay for something online, you already have a legal path to a usable code. Every option below gives you a code your bank stands behind and that you can dispute if something goes wrong.
- Your own physical card: the code is printed on the signature strip or the front face. Use it only on sites you trust.
- A virtual card number: many US banks and card issuers generate a disposable or merchant-locked number with its own CVV inside the bank's app or website. This is the closest thing to a "purchased" CVV that is real.
- A prepaid card: bought at a grocery store, pharmacy, or bank branch, then registered in your name. You get a code because you are the account holder.
- Business virtual card programs: finance teams issue single-use numbers with spending limits to employees and vendors.
- Authorized user cards: a family member or employer adds you to an account, and the issuer mails you a card with a code.
Why CVV listings fail on every parameter
Treat any paid CVV offer as a checklist of failures rather than a shopping option.
- Legality: buying or selling stolen account credentials and card data violates US federal law covering unauthorized access devices and identity theft. There is no safe jurisdiction to place the order from.
- Deliverability: the code you receive is often already used, already blocked, or simply invented. Card issuers cancel compromised numbers quickly.
- Price logic: if a code gave unrestricted access to a funded account, no seller would part with it for a few dollars.
- Your exposure: you must send payment and often personal details to the seller, which hands the same criminals your identity and banking information.
- Follow-on risk: buyers are frequently told the first code "failed" and pressured to pay again, which is an advance-fee scam with extra steps.
Parameters to check before you enter any card code online
These are the things worth verifying when you are the one paying with a card you legitimately hold.
- Does the checkout page use an encrypted connection and belong to the merchant you meant to buy from?
- Is the site asking for the code as part of a normal purchase, or asking you to send it by email, text, or chat? Legitimate merchants collect it in the payment form only.
- Does the seller accept a payment method you can dispute, such as a credit card, rather than gift cards, wire transfers, or crypto?
- Are there clear refund, shipping, and contact details on the site?
- Is the price too far below market for the item? That pattern often signals a storefront built to harvest card data.
Protecting your own CVV
- Never read the code aloud on a call you did not initiate. Banks do not ask for it.
- Do not store it in a note, email draft, or shared spreadsheet.
- Use a virtual number for subscriptions and unfamiliar merchants.
- Review statements each month and turn on transaction alerts.
- If a number is exposed, request a replacement card and new code from your issuer.
If you are dealing with card fraud
Report unauthorized charges to your issuer right away, since US cardholders have billing error dispute rights under the Fair Credit Billing Act. You can also file a complaint with the Federal Trade Commission and report internet-facilitated card crime to the FBI's Internet Crime Complaint Center. If someone tried to sell you a CVV, that report helps pattern the scheme for investigators.
This article is general information, not legal advice.