A CVV is one number on a payment card

A CVV is a 3-digit code printed on the back of a Visa, Mastercard, or Discover card, near the signature panel. American Express prints a 4-digit code on the front. Issuers call these CVV2, CVC2, or CID. The code is not encoded in the magnetic stripe or the chip. It is printed on the card and mailed with it.

Merchants use the CVV to confirm the buyer holds the physical card. Payment Card Industry rules bar merchants and processors from keeping the code after a transaction is authorized. A person who has a card number, an expiration date, and the CVV can place an online order.

There is no legal market for CVV numbers

A CVV belongs to the cardholder and the issuer. It is not a product. Sellers who advertise CVV numbers are offering data taken from other people's accounts. The purchase is not a gray area. Federal law treats the sale of a payment card number as trafficking in an access device.

What the law says

18 U.S.C. § 1029 covers access device fraud. Producing, selling, or possessing card numbers with intent to defraud falls under it. Federal penalties include fines and prison terms of 10 years or more on the most serious counts. Prosecutors charge cases that involve a few dozen cards and cases that involve millions. Sentences rise with the number of victims and the dollar loss.

The Federal Trade Commission and the FBI both list card fraud among the top sources of consumer complaints. The FBI's Internet Crime Complaint Center collects reports on carding markets.

Cardholders seldom pay

Under the Truth in Lending Act, a credit card holder who reports an unauthorized charge faces a maximum liability of $50. Visa, Mastercard, Discover, and American Express add zero liability policies on top of that. The party that absorbs the loss in most CVV fraud cases is the merchant or the issuer. That does not make the purchase legal. It changes who files the report and who works with investigators.

How the offers found online work

Posts that sell CVV numbers follow a pattern. The seller asks for payment in a form that cannot be reversed: gift cards, crypto, or a peer-to-peer transfer. Delivery is a text file or a chat message. The buyer cannot check the data before payment, and the seller keeps the money. Reports to the Internet Crime Complaint Center describe three outcomes:

• No data arrives after payment.
• Data arrives and fails at checkout because the issuer blocked the card.
• Data works once, then the buyer is locked out or pressured for a larger payment.

Buyers have no recourse. A payment network will not reverse a transfer made to buy a stolen card number, and a police report exposes the buyer to the same charge as the seller.

Card numbers you can buy, use, and own

Legitimate card numbers come from an issuer or a program manager, with a contract and an identity check. Options:

• Prepaid cards. Sold at retail. Load limits and fees are printed on the package.
• Virtual card numbers. Some banks and business card programs issue a single-use or merchant-locked number tied to your account.
• Secured credit cards. A cash deposit sets the limit. Activity reports to credit bureaus.
• Business cards. Issued to a company with an EIN and a personal guarantee.

Parameters to check on any card product

These are the numbers that decide the cost:

• Annual fee and monthly maintenance fee.
• Load fee, reload fee, and cash withdrawal fee.
• Foreign transaction fee, stated as a percentage.
• Maximum balance and monthly load cap.
• Deposit insurance. FDIC or NCUA coverage applies when the funds sit at an insured bank.
• Identity verification. A product that skips it is not a deposit account.
• Dispute process. Written terms, a phone number, and a named issuer.

Pitfalls

• Sellers on forums, chat apps, and social media. Payment is irreversible and the goods are illegal.
• Sites that show a live check or a balance screenshot. Screenshots are edited or copied from other buyers' orders.
• One card number resold to many buyers. The first use triggers an issuer block and the rest fail.
• Offers to test a card for you. This is a way to collect your payment and your personal data.
• Requests for your own card details to verify you. This is a phishing step.

Bottom line

A CVV is a security code tied to one account. No issuer sells one. If you need a card number to make online payments, a prepaid card or a virtual number from your own bank gives you a number you control, terms you can read, and a dispute path when something goes wrong.