Can you buy a CVV legally?

No. A CVV is a security code tied to a real person's payment card, and it is not a product any bank, processor, or merchant sells to the public. Anyone offering to sell you one is selling stolen card data or running a scam against you.

Buying, selling, or possessing stolen card numbers and CVVs is a federal crime in the United States under 18 U.S.C. § 1029, which covers access devices and fraudulently obtained card credentials. Penalties include prison time and fines, and the charge can stack with wire fraud and identity theft counts.

What is actually being sold in those markets?

Sellers who advertise card numbers and CVVs operate outside any legal payment system. The inventory is either stolen from real cardholders or invented to take money from buyers.

• Stolen data. Card numbers pulled from breaches, skimmers, or phishing. The cardholder usually reports the charge, and the transaction gets reversed.
• Fabricated data. Random digits sold as "fresh" cards. You pay and receive nothing usable.
• Advance-fee setups. The seller asks for a deposit, a "verification" payment, or crypto to "activate" the card, then disappears.

Prices on illegal markets are low because the goods are unreliable and the supply is stolen. A cheap CVV is cheap for the same reason a stolen bicycle is cheap. Nobody stands behind it.

Who carries the risk?

The cardholder is protected. Under federal law and card network rules, victims of unauthorized charges are not liable for the fraudulent amount, and banks refund the charge after an investigation.

The buyer has no protection at all. There is no chargeback, no dispute process, and no way to complain without admitting to a crime. Law enforcement builds these cases from chat logs, wallet addresses, and delivery records.

What should you do instead?

If you need to pay online safely, the legitimate tools already exist. Virtual card numbers from your bank or card issuer let you generate a one-time number with a spending limit. Prepaid cards, digital wallets, and PayPal-style services work the same way without exposing your main account.

If your goal is security research or fraud prevention work, that runs through controlled channels: your employer's security team, a bug bounty program, or a licensed testing agreement with the card issuer. Those paths come with authorization in writing, which is what separates research from a crime.

If you have already sent money to a seller advertising CVVs, treat it as fraud. Contact your bank, file a report with the FBI's Internet Crime Complaint Center, and stop all contact with the seller.