There is no legitimate place to buy a CVV online. Any site that sells card verification values, "fullz", or card dumps is trading stolen payment data, and in the US that is access device fraud under 18 U.S.C. § 1029. The shops that advertise hardest are scams, police stings, or both.

So the useful version of the answer is a warning plus the legal path. Below: what a CVV is, why these shops fail on their own terms, the penalties, the red flags, and the legitimate services people are usually looking for.

What is a CVV and why can't you buy one?

A CVV is the 3-digit code on the back of most Visa, Mastercard, and Discover cards, and the 4-digit code on the front of an American Express card. It confirms the person paying holds the physical card.

Card networks bar merchants from storing it. PCI DSS Requirement 3 says the CVV must not be kept after authorization, even in encrypted form. A shop that claims to hold "fresh CVVs" is claiming to keep data that no compliant processor is allowed to retain.

The only party that can issue a CVV is the bank that issued the card, to the person whose name is on the account.

Why do people say CVV shops work?

Because the marketing is good. Read the mechanics and the same three failures show up.

The numbers are dead on arrival

Banks flag and reissue a card the moment odd charges appear, and stolen numbers get resold to many buyers at once. The first buyer might get one charge through. Then the card is canceled.

The shop keeps your money

Payment is Bitcoin, USDT, or a gift card. There is no chargeback, no escrow, no support line, and no complaint you can file, because the thing you paid for was stolen data. "Replacements" and "VIP support" are upsells designed to get a second payment.

Some of those shops are the police

US and European agencies run carding forums and fake storefronts as bait. Buying from one puts your IP, wallet, and delivery address in a case file.

The seller keeps your data too

Buyers hand over real names, addresses, and crypto wallets. Some shops resell that list onward, which is how buyers end up as victims of the same trade.

What are the penalties for buying card data in the US?

• 18 U.S.C. § 1029 covers trafficking in access devices: up to 10 years for a first offense, 15 for a second, plus fines.
• Aggravated cases, such as large batches of cards or high dollar losses, reach 20 years.
• State laws add identity theft and computer crime charges on top of the federal count.
• Civil suits from card issuers can follow a criminal case.

Sentencing depends on the number of cards and the dollar loss. Buying a single number does not make the offense small.

How do you spot a site selling stolen card data?

• Crypto-only checkout, with no business name, address, or registered entity.
• Prices per card listed in the $5 to $50 range, with bulk discounts.
• Vouches and testimonials from accounts created the same week.
• Terms that warn against "carding" while the site sells card data.
• A domain registered a few months ago, sitting on a host known for ignoring abuse reports.

Any one of these is a reason to close the tab. A legitimate payment provider will show a registered company, a card network sponsorship, and a compliance contact you can reach.

What is behind these searches?

Most of this traffic comes from three needs: paying for online services without exposing a main card, accepting card payments as a merchant, or testing a checkout flow. All three have legal suppliers.

Virtual cards for your own spending

Banks and fintechs issue single-use or merchant-locked virtual cards tied to your own account. You get the same protection against a leaked number, with no stolen data involved. Look for an issuer that discloses a partner bank.

Prepaid cards

Reloadable prepaid cards work for subscriptions and online purchases and are sold at any pharmacy. Register the card if you want the right to dispute a charge.

Merchant accounts and payment gateways

If the goal is to take payments, apply through a processor or payment facilitator. Underwriting takes days, not minutes, and that review is the point.

Testing your own checkout

Processors publish sandbox keys and test card numbers for developers. Never test with a live card you do not own.

FAQ

Is it legal to buy a CVV online?

No. A CVV belongs to the cardholder, not to the person holding the number. Buying or selling it without the account owner's consent is access device fraud in the US and a criminal offense in most other countries.

Can you buy CVVs with Bitcoin?

You can send Bitcoin to a shop that claims to sell them. You will lose the money or receive dead numbers. Blockchain analytics firms trace these payments for law enforcement.

Where do I report a site that sells card data?

File a complaint with the FBI's Internet Crime Complaint Center and the FTC, and forward the domain to the card network's fraud team. Include the wallet address if you have one.

Is a virtual card the same as a CVV?

Close. A virtual card has its own number, expiry, and CVV, but a bank issues it to you against your own funds. It works for online purchases and can be frozen or replaced at no cost.

The short version

No legitimate seller exists, the shops that pretend to be one take crypto and give nothing back, and the legal exposure starts at a decade in federal prison. If you need a card number for online purchases, get a virtual card from your bank. If you need to accept payments, apply for a merchant account.