Short answer

There is no legal place to buy a CVV. A CVV or CVC is the 3-digit code on the back of most cards, or the 4-digit code on the front of American Express cards. The code proves the buyer holds the physical card. It belongs to the cardholder and the issuing bank. Selling or buying card numbers and CVV codes is a federal crime in the US under 18 U.S.C. 1029, access device fraud. Sites and chat channels that advertise "CVV for sale" sell stolen card data, or they take payment and send nothing.

related article

What people search for instead

Three needs sit behind this query.

Can You Buy a CVV Online? Legal Risks and Safe Payment Options

  • Testing a checkout flow. Processors such as Stripe and Adyen publish sandbox test cards. No real card data is involved.
  • Paying online without exposing a real card number. A virtual card from a bank or fintech covers this need.
  • Paying a merchant that declines a card. A prepaid card or a network token works.

Where you can get card numbers for real purchases

Issuer virtual cards

Several large US issuers offer virtual card numbers inside their mobile apps. The bank issues a separate 16-digit number, expiration date, and CVV tied to your account. You can set a spend cap and close the number at any time. Availability varies by card tier, so check the app or call the number on the back of your card.

related article

Fintech and business platforms

Privacy, Mercury, Ramp, Brex, and Revolut issue virtual cards. Most require an identity check: legal name, address, date of birth, and a Social Security number or employer ID number. Limits, fees, and spend controls differ by plan.

Buy CVV Online From a Trusted Source: A Merchant's Guide to Verification Services

Prepaid cards

Visa and Mastercard prepaid cards sell at Walmart, CVS, Walgreens, and grocery chains. Load limits run from $20 to $1,000 in many states. These cards work for online purchases that accept card-not-present payments. Register the card to unlock higher limits and online use.

Tokenized checkout

Visa Token Service and Mastercard Digital Enablement Service replace the card number with a token that is unique to a merchant or device. The CVV stays with the issuer and never reaches the merchant. Apple Pay, Google Pay, and Shop Pay use this approach.

Parameters to compare

  • Identity checks. Banks and fintechs run KYC. Prepaid cards under a set balance often skip it.
  • Spend limits. Check the per-transaction cap and the monthly cap.
  • Merchant restrictions. Some virtual cards block subscriptions, travel holds, or merchants outside the US.
  • Fees. Compare card issue fees, monthly fees, foreign transaction fees, and load fees.
  • Reuse. Single-use numbers die after one charge. Merchant-locked numbers can recur for subscriptions.
  • Dispute path. A chargeback on a virtual card follows the same rules as a physical card. Regulation E covers some prepaid cards, but protections vary.

Pitfalls

  1. "CVV store" listings. Cards sell for $1 to $40 on carding forums. Buyers get dead numbers, numbers that were already used, or a file that contains malware.
  2. Escrow claims. Sellers in Telegram channels claim escrow and "checker" bots. No chargeback exists. Funds move by crypto or gift card.
  3. Free CVV samples. These are bait. Sellers use them to collect contact data or to test their own stolen cards.
  4. Card testing services. Paying a person to run small charges on a card is fraud, even if the card belongs to you. Processors terminate accounts that show this pattern.
  5. Fullz bundles. Packages with name, address, SSN, and CVV carry higher federal sentences. The seller logs the buyer's IP address.
  6. Reshipping. Receiving goods bought with stolen cards adds money laundering counts to the fraud charge.
  7. Wire and crypto payments. No consumer protection and no refund path.

If a card number leaks

  1. Freeze the card in the bank app or call the number on the back.
  2. Report the charge to the issuer. Record the date, amount, and merchant name.
  3. File a report at IdentityTheft.gov if personal data leaked with the card.
  4. Place a credit freeze with Equifax, Experian, and TransUnion. The freeze is free.
  5. Change passwords on shopping accounts and turn on two-factor authentication.

What merchants should do

PCI DSS Requirement 3.2 forbids storing the CVV or CVC after authorization. Keep the last four digits and a token. Use a processor with PCI DSS Level 1 certification. Log failed CVV checks and rate-limit attempts. Card testing shows up as many small declines from one IP address in a short window.

Costs

Virtual cards from US banks cost $0 in most accounts. Fintech cards run $0 to $10 per month. Prepaid cards cost $3 to $10 to buy, plus load fees of $1 to $5. A stolen "CVV" costs $1 to $40 and has no legal use.