The short answer
You cannot buy CVV or CVC codes from a legitimate seller. The three or four digit code on a card is generated by the issuing bank and issued only to the cardholder. Anyone advertising fresh CVVs, fullz, or card dumps is either selling stolen data or running an advance-fee scam. The first outcome carries criminal exposure under US wire fraud and access device statutes. The second outcome just takes your money with no recourse.
What those offers actually are
Search results, forum posts, and chat ads for CVV shops fall into three groups:
How to Buy CVV Online Safely: A Comprehensive Buying Guide
- Stolen card data resold from breaches and skimmers. Buying it is a federal crime, and the seller often keeps a copy of the number to drain the account again after the sale.
- Fake shops that collect cryptocurrency or gift card codes and never deliver anything.
- Collection operations run by other criminals who harvest your identity details and contact list for later extortion.
How to judge a checkout page before you type your CVV
- Check the address bar and confirm the padlock icon and the exact domain name.
- Open the certificate details and read the issuer and the registered organization.
- Confirm you reached the merchant by typing the address yourself or by a saved bookmark.
- Watch for a redirect that moves you to a different domain at the payment step.
- Stop if the page asks for your card PIN, your full Social Security number, or a photo of the card.
- Close the tab and clear the form if anything above fails, then contact the merchant through a phone number you looked up separately.
Parameters that separate a real merchant from a fake
- PCI DSS compliance. Reputable processors publish their compliance status and do not store the CVV after authorization.
- Tokenization. Your card number is replaced with a token so the merchant never holds the full PAN.
- 3-D Secure or one-time passcode prompts from your bank at checkout.
- A written refund, cancellation, and dispute policy with a reachable support address.
- A business address and a phone number that resolve to a real entity.
Pitfalls to avoid
- Paying a stranger with crypto, wires, or gift cards. None of these can be reversed.
- Trusting a screenshot of a card or a dashboard as proof of inventory.
- Sharing your own CVV in chat, email, or a support ticket.
- Using a debit card on an unverified site, where the money leaves your account before a dispute can start.
If your own card data has leaked
- Call the number on the back of your card and ask for a block and a reissue.
- Turn on transaction alerts in your banking app.
- Pull your free credit reports and look for accounts you did not open.
- File a complaint with the FBI Internet Crime Complaint Center if you paid a seller who never delivered.
Legitimate ways to keep your CVV out of circulation
Ask your bank for virtual card numbers and use a fresh one per merchant. Set a spending cap on each virtual number. Use a payment service that issues a single-use code so the real CVV is never transmitted. Review saved cards in every shopping account and delete the ones you no longer use. These steps reduce your exposure without any need to buy card data from anyone.