A CVV is the 3-digit security code printed on the back of most Visa, Mastercard, and Discover cards, or the 4-digit code on the front of American Express cards. It exists to prove that the person paying holds the physical card. No bank, payment network, or licensed merchant sells CVVs, so any site that offers them for sale is trading in stolen account data.

v2

What does CVV stand for?

CVV stands for Card Verification Value. Visa coined the term, Mastercard calls the same code a CVC (Card Verification Code), and American Express calls it a CID (Card Identification Number). All three do the same job at checkout.

v3

The code is separate from your card number and your PIN, and merchants are not allowed to print it on receipts. There are two versions of the code on most cards:

read more

• CVV1: encoded in the magnetic stripe or chip, read by a terminal when you dip or tap the card in person.
• CVV2: the printed code you type into an online form or read over the phone.
• PIN: a number you choose, used at ATMs and debit terminals for cash and balance checks.

Is there a legal place to buy a CVV?

No. A CVV belongs to one card and one account, and only the cardholder's bank can issue it. There is no wholesale market, reseller program, or bulk price list for CVV codes.

read more

The phrase "buy CVV" describes carding: the trade in card numbers, expiration dates, and security codes taken from data breaches, phishing pages, or skimming devices. That trade runs on criminal forums and private chat channels, and the people selling there are not vendors you can complain to when a deal goes wrong.

How fake CVV shops operate

A typical "CVV shop" shows a searchable list of card numbers with country, bank name, and a balance figure. Buyers pay in cryptocurrency and receive the data through a bot. The inventory comes from stolen sources, not from any legitimate bank feed.

The business model leans on the buyer's hope of quick profit, and it fails on nearly every count:

• Dead cards. Banks cancel compromised cards fast, and card-not-present transactions from unknown devices trigger fraud rules.
• Exit scams. Many sites collect crypto and never deliver, then reopen under a new name.
• Malware. Some shops wrap their login pages or "checker" tools with info stealers aimed at the buyer.
• No recourse. You cannot dispute a payment for stolen card data without describing your own crime to a bank or a court.

Is buying a CVV illegal in the United States?

Yes. Under 18 U.S.C. § 1029, trafficking in or using unauthorized access devices carries fines and prison terms of up to 10 years, with longer terms for aggravated cases. State laws add identity theft and fraud charges on top of the federal count.

An attempt counts. If you use a stolen CVV to place an order and the charge is declined, the offense still happened. Buying a single card number is enough to support a charge under the statute.

How to keep your own CVV safe

You cannot stop a retailer's database from leaking, but you can limit what a leak costs you.

1. Never type your CVV into a form that arrived through an email link or a text message. Open the merchant's app or type the address yourself.
2. Use virtual card numbers from your bank or card issuer for subscriptions and unfamiliar stores. Each virtual number carries its own code and can be turned off after one use.
3. Cover the code when you hand your card to a server, and check that the card you get back is yours.
4. Turn on transaction alerts so a charge you did not make reaches you within minutes.
5. Keep your phone and laptop patched. Info stealers grab card data from browsers, not from the card itself.

What to do if your card details leak

Act on the card first and the paperwork second. A new card number stops most of the damage before it starts.

1. Call the number on the back of your card, report the leak, and ask for a new card number and CVV.
2. Review statements for small test charges, often one or two dollars, that a thief uses to check if the card works.
3. Dispute any charge you did not authorize. Federal law caps your liability for unauthorized credit card use at $50, and many issuers waive it.
4. Report identity theft at IdentityTheft.gov to get a recovery plan, and file a complaint with the FBI's Internet Crime Complaint Center.

Frequently asked questions

Can I buy a CVV for my own card?

You do not need to. The code is printed on the card itself. If the printing has worn off, your issuer can mail a replacement or read the code to you after identity checks.

Do online stores store my CVV?

Payment Card Industry rules bar merchants from keeping the CVV after a transaction is authorized. If a store claims it needs your code on file for future orders, that is a warning sign.

Why does a store ask for my CVV a second time?

Some merchants re-verify the code for a delayed charge, a subscription renewal, or a large order. The request should always appear inside the merchant's own checkout page, never in a message asking you to reply with the number.

Are CVV and PIN the same thing?

No. The CVV proves the card is present. The PIN proves the person using it knows a secret. A thief with your card number and CVV still cannot withdraw cash from an ATM.