Short answer

There is no buying guide to give here. Card verification values sold in "cheap CVV shops" are stolen payment credentials taken from real cardholders, and US law treats buying, selling, or possessing them as trafficking in unauthorized access devices. That is a federal offense, not a gray-market shortcut. The marketplaces themselves are also unreliable by design: sellers routinely resend dead cards, buyers have no recourse, and the operators log buyer identities to resell later.

What actually happens in these shops

Listings advertise low prices because the underlying data is low quality: expired cards, cards already flagged by issuers, or numbers from breached databases that no longer authorize. Payment is usually demanded in cryptocurrency, so a bad batch cannot be refunded or disputed. Buyers who complain are banned. Buyers who keep paying become visible targets for extortion, since the operator holds their contact details and transaction history.

Legal exposure

• Trafficking in card numbers and CVVs carries statutory penalties under 18 U.S.C. 1029, including prison terms and fines.
• Possession alone can support a charge when intent to defraud is shown.
• Cross-border purchases do not shield a US buyer from prosecution.

If your own card data was exposed

1. Lock or freeze the card in your bank app, then call the issuer using the number on the back of the card.
2. Dispute every charge you do not recognize in writing and keep the confirmation number.
3. Request a replacement card with a new number and CVV rather than a reissue of the same number.
4. Change passwords on any shopping account where the card was saved, and turn on transaction alerts.
5. File a report with the FTC at IdentityTheft.gov and, for online marketplace fraud, with the FBI's IC3.
6. Check your credit reports for accounts you did not open, and place a free fraud alert if anything looks wrong.

Pitfalls to avoid

• Do not pay anyone who claims they can "clean" a flagged card or restore access for a fee.
• Do not share one-time passcodes or banking app screenshots with a buyer, seller, or "verification agent."
• Do not assume a small test charge proves a card is live; issuers approve small amounts on cards that later decline.

For merchants

Never store the CVV after authorization. PCI DSS requires that the value not be retained in any form, and keeping it turns a routine breach into a carding dataset. Tokenize, segment the network, and log access to the cardholder data environment.