What a CVV buying site is

A CVV buying site is a storefront that sells stolen payment card records. The listing holds a card number, a cardholder name, an expiration date, and the card verification value. Buyers pay in cryptocurrency. The sites run on the open web, on Tor, and inside private chat groups. Each one is illegal in the United States.

CVV Purchase Opportunity: A Comprehensive Buying Guide

CVV stands for card verification value. Visa, Mastercard, and Discover print 3 digits on the back of the card. American Express prints 4 digits on the front. Banks use the code to confirm that a person holding the card number also holds the card.

CVV Acquisition Choice Guide: A Comprehensive Buying Guide

Why the term appears in search results

Most searches come from two groups. The first group holds a card and wants to know if a site that asks for a CVV is real. The second group searches after a data breach notice arrives by mail. Both groups land on the same pages: fraud forums, news reports about carding arrests, and consumer advice from banks.

more on this topic

Federal law

18 U.S.C. 1029 covers access device fraud. A first offense carries up to 10 years in prison. A second offense carries up to 15 years. 18 U.S.C. 1028 adds penalties for identity theft. 18 U.S.C. 1343 covers wire fraud and carries up to 20 years. Federal prosecutors bring these charges against sellers and against buyers.

CVV Acquisition

What buyers receive

Card records go stale. A bank cancels a card within hours of a fraud alert. Sellers claim a balance that no bank confirms. Buyers have no refund path, no customer service, and no legal remedy, because the transaction itself is a crime.

How card data leaves a cardholder

• Skimmers attached to gas pumps and ATMs
• Phishing pages that copy a bank login screen
• Malware on a point-of-sale terminal
• Breaches at a merchant that stores card numbers

How to report card fraud

1. Call the number on the back of the card. The issuer cancels the card and opens a dispute.
2. File a report at IdentityTheft.gov, run by the Federal Trade Commission.
3. File a complaint with the FBI Internet Crime Complaint Center.
4. File a police report if a local agency requires one for the dispute.

How cards are protected

Chip cards create a one-time code for each purchase. Tokenization swaps the card number for a random string at checkout. 3-D Secure sends a prompt to the cardholder phone during an online order. These three steps block most card-not-present fraud. A cardholder can also freeze a card in a banking app and set transaction alerts.

No legitimate business sells card verification values. A site that offers them is a fraud operation, and payment for a record funds more theft.