The short answer
There is no legal place to buy a CVV. A CVV is the three or four digit code on a payment card. It proves the person typing the number holds the physical card. Buying one, selling one, or holding a list of codes tied to other people's accounts is card fraud.
CVV Vendors on Dark Web List: A Comprehensive Guide
In the US, 18 U.S.C. § 1029 covers access device fraud. A first offense carries up to 10 years. Repeat or aggravated cases reach 15 years. The buyer commits a federal crime, not only the seller.
Card networks treat the CVV as sensitive authentication data. PCI DSS Requirement 3.2 forbids storing it after authorization. No legitimate merchant, processor, or reseller can sell it to you.
What the listings actually are
Searches for card data lead to three kinds of pages. None of them sell a working CVV.
- Exit scams. A shop takes crypto, shows a sample, then closes. The buyer has no recourse. Reporting a loss means describing your own crime.
- Bait lists. Posts offering free CVVs collect email addresses, IP logs, and wallet IDs. The codes are dead or invented.
- Seized sites. The DOJ and partner agencies have taken over carding forums and run them for months. Buyers who place orders become records in an investigation.
Telegram sellers and "checker" tools follow the same pattern. A checker tests whether a card is live. Running one against cards you do not own is the same offense as buying them.
Why the codes fail anyway
A stolen CVV rarely survives a checkout. Issuers score each card-not-present transaction on device, geography, velocity, and address match. A code that worked yesterday can decline today. Fraud teams also void cards in batches once a breach is traced.
Chargebacks land on the merchant. The merchant then tightens checks, which raises the decline rate for everyone using that card. The buyer's crypto is gone and the card is dead.
Protect your own CVV
- Never read the code aloud on a call you did not start.
- Do not store it in a browser, note app, or photo roll.
- Use a virtual card number for subscriptions and one-off sites.
- Turn on transaction alerts for every charge above your set limit.
- Check your statement weekly. Small test charges often come first.
Parameters that matter at checkout
These are the controls a real merchant runs. They are also the reason stolen codes fail.
- CVV match. The issuer confirms the code against its records. A mismatch declines the sale.
- AVS. The billing address number and ZIP must match. Partial matches trigger manual review.
- 3-D Secure. The issuer sends a push or one-time code to the cardholder's phone. A stolen CVV cannot pass this step.
- Tokenization. The merchant stores a token, not the card number or code. A breach then leaks nothing usable.
- Velocity limits. Repeated attempts on one card or one IP address get blocked.
Pitfalls
- Sending crypto to a seller. Funds move one way. There is no dispute process.
- Sharing wallet IDs or email with a forum. Those records persist and get shared with investigators.
- Assuming a small test charge is safe. Issuers flag the test and freeze the account.
- Trusting a "verified vendor" badge. Badges are self-issued on sites that police themselves.
- Believing a code seller's refund policy. A refund on stolen data is not a contract a court will enforce.
What to do instead
If a charge appears that you did not make, call the issuer using the number on the back of your card. Request a replacement card and a new CVV. Report the event at IdentityTheft.gov and to the FTC. If you are considering a purchase of card data, the answer is that no such legal market exists, and the penalty falls on you.