V4 is not a real card security code. The four major networks label their verification codes CVV2, CVC2, CID, and CVN2, and none of them uses the term "v4." When an online seller lists "v4" card data, that is fraud slang, and buying or selling it breaks US federal law.

v2

What is a CVV code?

A CVV (card verification value) is the 3 or 4 digit code printed on a payment card. It proves the person placing a card-not-present order holds the physical card. Visa calls it CVV2, Mastercard calls it CVC2, American Express calls it CID, and Discover uses the same 3-digit layout as Visa.

related article

• American Express: 4 digits on the front, above the card number.
• Visa, Mastercard, Discover: 3 digits on the back, inside the signature panel.

Where does the "v4" label come from?

"V4" shows up in forum posts and chat channels that trade stolen payment records. It has no technical meaning and no official definition. Sellers borrow version numbers from software to make a criminal listing sound like a product launch.

read more

Records sold under tags like this are known as fullz. A fullz bundle carries the card number, expiry date, cardholder name, billing address, and security code. Nothing in that bundle is legal to buy, and the account gets frozen as soon as the real owner disputes a charge.

v3

Is buying CVV data illegal in the United States?

Yes. Federal law bans the sale and purchase of stolen card credentials, and charges can be filed before the data is ever used.

• 18 U.S.C. § 1029 covers trafficking in unauthorized access devices, which includes card numbers and verification codes. Penalties reach 10 years for a first offense and 15 for repeat offenses.
• 18 U.S.C. § 1028 covers identity theft and document fraud.
• 18 U.S.C. § 1343 covers wire fraud, which applies to online payments used to buy or sell the records.

Proof of a marketplace transaction plus intent to use the data is enough for a case. A completed fraudulent purchase is not required.

How do stolen card numbers reach the market?

• Skimmers fitted to gas pumps, ATMs, and self-checkout lanes copy the magnetic stripe.
• Phishing pages clone bank and retailer logins.
• Breaches at merchants that store cardholder data.
• BIN attacks, where bots guess valid numbers in bulk.
• Malware on a cardholder's phone or a store's point-of-sale terminal.

Why CVV shops are a bad deal for the buyer

Most storefronts that advertise card data take payment and deliver nothing. Others pass along records that banks have already flagged, so the first charge declines or trips a fraud alert. The buyer holds all the legal risk and none of the leverage, and the seller vanishes after the transfer.

Payment processors and law enforcement watch these channels. One transaction creates a payment trail that leads back to the account that funded it.

What does a CVV actually protect?

Merchants that follow PCI DSS rules cannot store the CVV once a transaction is authorized. That limit matters after a breach, because a stolen card number alone cannot complete most online orders without the code. Networks add address verification and 3-D Secure checks that flag a mismatch between the billing address and the order.

How to protect your own card and CVV

• Cover the keypad and the card at terminals and ATMs.
• Use a virtual card number for subscriptions. Many issuers generate a fresh number and code per merchant.
• Turn on alerts for every charge above a set amount.
• Skip saved card details in browsers and shopping apps when guest checkout is offered.
• Review statements each week and report unknown charges within 60 days to keep full protection under the Fair Credit Billing Act.

What to do if your card data leaks

1. Freeze the card in your bank app.
2. Ask for a new card number and a new CVV.
3. Change passwords on banking and shopping accounts and turn on two-factor authentication.
4. Pull your free reports at AnnualCreditReport.com and dispute accounts you do not recognize.
5. File a report at IdentityTheft.gov if someone opens new accounts in your name.

Where to report card fraud and CVV listings

Send fraud reports to the FTC at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov. Your bank takes reports too, and an early report lets it close the account before more charges land.

Frequently asked questions

Is a CVV the same as a PIN?

No. A PIN authorizes chip and ATM transactions with the card present. A CVV verifies online and phone orders where no card is swiped.

Can a merchant store my CVV?

PCI DSS forbids storing the CVV after authorization. If a support agent asks you to read the code from an old receipt, treat the request as a red flag.

Does "v4" appear on any real card?

No. You will not find "v4" printed on a card, a statement, or a bank portal. The label exists only in fraud listings.

What penalty does a CVV buyer face?

Charges under 18 U.S.C. § 1029 carry up to 10 years in prison for a first offense, 15 years for repeat offenses, plus fines and restitution to victims and banks.