Answer first

A CVV is a 3 or 4 digit code printed on a payment card. It proves the person entering card data holds the physical card. Buying a CVV from a third party means buying a code tied to someone else's account. There is no legal option for that in the United States. Federal law treats the sale and purchase of card account data as access device fraud under 18 U.S.C. 1029. Sites that advertise CVV sales are fraud marketplaces, exit scams, or both.

cvv purchase website

What a CVV is

Visa, Mastercard and Discover print a 3 digit code on the back of the card. American Express prints a 4 digit code on the front. The code is not written in readable form on the magnetic stripe or the chip. Merchants that take orders by phone, mail or online request it to lower fraud risk. A card number plus expiration date plus CVV is enough to place a card-not-present order.

more on this topic

What CVV shops are

Listings on these sites pair a card number with an expiration date, a CVV and sometimes a name, address and bank name. That data comes from data breaches, skimmer devices on gas pumps and ATMs, phishing pages, and employees who copy records. Some operators take cryptocurrency and deliver nothing. Others deliver one working record and then demand more payment. There is no reliable public count of active CVV shop domains. Seizure totals from the FBI and Europol change each year, and operators move to new domains after takedowns.

more on this topic

Legal exposure for buyers

18 U.S.C. 1029 covers fraud and related activity connected to access devices. Trafficking in a counterfeit or unauthorized access device carries a fine and up to 10 years in prison for a first offense. A prior conviction under the same section raises the maximum to 15 years. Cross-state purchases and computer use can add wire fraud charges under 18 U.S.C. 1343. State prosecutors file separate cases for identity theft and computer crimes. Banks can sue for losses after a criminal case ends.

How to Safely Buy CVV Websites: A Comprehensive Buying Guide

What cardholders owe

Under the Truth in Lending Act, a credit card holder owes no more than $50 for unauthorized charges. Under the Electronic Fund Transfer Act, debit card liability is $50 if the holder reports the loss within 2 business days, $500 if reported within 60 days, and larger amounts after that. Many banks waive the $50. The holder still deals with a frozen account, a replacement card and credit report entries.

Scam patterns on these sites

• Payment in bitcoin with no delivery.
• A pitch to buy a balance checker tool that installs malware on the buyer's device.
• A fake escrow service run by the same operator.
• A deposit request before a test transaction.
• Phishing pages that harvest the card numbers the buyer types in.

Steps after card fraud

1. Call the issuer and freeze the card.
2. File a report at the FTC IdentityTheft.gov site for a recovery plan.
3. Send a complaint to the FBI Internet Crime Complaint Center.
4. Read statements for charges of $1 or less. Small charges test whether an account is live.

Unknowns

Public data does not show how much money moves through CVV shops each year. Loss estimates from card networks mix card-not-present fraud with other categories, so the numbers are not separable.