The short answer before anything else
No legitimate "CVV shop" buys card data. A CVV shop is an underground storefront for stolen card numbers, and every participant on either side, the seller uploading dumps and the buyer purchasing them, is committing card fraud under US federal law. That means the honest buying decision in front of you is not which shop to use. It is which fraud-prevention and card-data security tooling your business should buy so that CVV and CVC data never enters an unprotected system in the first place. The rest of this guide covers exactly that: what to evaluate, which numbers to demand, and where buyers of security software get burned.
If you arrived looking for a list of marketplaces, this guide will not provide one. What it will do is explain how those markets operate, why they are hostile to both sides, and how to spend your budget on controls that hold up to review.
Why the underground CVV market is a bad market by design
Card-data marketplaces run on the same trust problem as any black market: neither party can enforce a contract. Escrow services in these spaces are routinely operated by the same people running the shop, so a seller who uploads valid data can be told the data failed validation and never be paid. Buyers receive data that has already been used, is from a closed account, or was never valid. There is no support channel, no chargeback, and no regulator. The one reliable outcome is legal exposure: trafficking in unauthorized access devices is a federal offense, and card-not-present fraud is a standing priority for federal investigators and card networks alike.
What to look for when buying card-data security
- Scope of card data handled. The best purchase is one that removes CVC from your environment entirely. Prefer vendors whose integration tokenizes or hosts the payment fields so your servers never see a full PAN or a CVC.
- PCI DSS alignment. Ask for the vendor's level of PCI DSS validation and whether they will sign as a service provider on your attestation. A vendor that cannot describe its own compliance scope is a vendor that will expand yours.
- CVV and AVS verification behavior. Confirm how the tool responds to a CVC mismatch versus an AVS mismatch, and whether declines are logged with reason codes you can act on.
- 3-D Secure support. Check whether the vendor supports the current 3DS protocol version and can apply risk-based exemptions rather than challenging every transaction.
- Rule and model transparency. You need to see which rules fired on a blocked order. Opaque scoring is unusable during dispute review.
- Data residency and retention controls. Confirm retention windows are configurable and that card data is not retained beyond authorization.
Parameter bands worth setting as purchase requirements
- Chargeback ratio: card network monitoring programs generally start at 0.5% of transactions and escalate near 0.9%. Buy tooling that reports this ratio daily, not monthly.
- False positive rate: target a decline rate on legitimate repeat customers under 2%. Above 5%, you are losing revenue to your own filter.
- Authorization latency: added fraud checks should stay under 300 ms at the 95th percentile, or you will lose checkout conversions on mobile.
- CVC mismatch handling: a CVC mismatch should never be the only signal. Require at least two independent signals before a hard block.
- Uptime commitment: 99.9% monthly with defined credits is the floor for anything sitting inline at checkout.
- Pricing model: compare total cost at your real volume across per-transaction, percentage-of-volume, and platform-fee models. Percentage pricing punishes high average order values.
Pitfalls that catch first-time buyers
- Buying a filter, not a control. Rules that block suspicious orders do nothing about card data sitting in your logs.
- Trusting a compliance badge. A logo on a website is not an attestation. Ask for the document.
- Ignoring the review queue. Manual review capacity is part of the purchase. A queue nobody works is a refund generator.
- Skipping the trial window. Run the tool in monitor-only mode for at least one full billing cycle before it can block orders.
- Assuming small merchants are not targeted. Automated card testing hits small checkout pages precisely because they are lightly defended.
- Forgetting chargeback representment. Confirm whether dispute evidence submission is included or sold separately.
FAQ
Do any CVV shops buy data legally?
No. Purchasing or selling card numbers without authorization from the cardholder and issuer is a crime in the US, regardless of how the marketplace describes itself.
Sending CVV to Shops for Payment: A Buying Guide
What should I do if someone offers to sell me card data?
Do not engage. Report the solicitation to your payment processor's fraud team and to the appropriate federal reporting channel.
Is my business liable if a customer's CVC is stolen from my site?
Contractually, yes. Card network rules place data-security obligations on merchants and their service providers, and breaches can trigger fines, assessments, and loss of processing privileges.
What is the single highest-value control to buy?
Hosted payment fields that keep CVC out of your infrastructure. It removes an entire category of exposure for a predictable monthly cost.