Can You Buy a CVV Legally?
No. You cannot buy a CVV, because a CVV is a security code tied to a real payment card and it is never sold as a product. Every site or chat account that claims to sell CVVs is running a scam, harvesting your details, or working with investigators. Buying a CVV counts as payment card fraud and carries felony charges in most countries.
The rest of this page covers what a CVV actually is, why no legitimate market exists for it, and how to handle your own card data when you buy greeting cards or gifts online.
What Is a CVV?
The CVV is the short code printed on a payment card. Visa, Mastercard, and Discover put three digits on the back, next to the signature strip. American Express prints four digits on the front, above the card number.
Card networks use different names for the same thing. Visa calls it CVV2, Mastercard calls it CVC2, American Express calls it CID, and some banks print CSC. The code is generated from the card number, the expiry date, and a secret key held by the issuer.
Merchants ask for it when the card is not physically present. That covers online shops, phone orders, and mail orders. The code is a weak but useful signal that the buyer holds the actual card.
Why There Is No Real Market for CVV Data
Payment industry rules forbid storing CVV data after a transaction is approved. PCI DSS Requirement 3.2 blocks merchants and processors from keeping sensitive authentication data, which includes the full magnetic stripe, the PIN block, and the CVV.
That means no legitimate business holds a warehouse of CVVs it could sell you. If you run a greeting card shop, you collect the code once, you pass it to your processor, and you drop it.
The CVV data that circulates online comes from skimmers on fuel pumps and ATMs, breaches at weak merchants, and phishing pages. All of it is stolen, and all of it belongs to someone who will file a chargeback.
What Happens When Someone Tries to Buy CVV Online
Vendors you find through search results or messaging apps almost never hand over working card data. The same patterns repeat:
- You pay in crypto and get nothing. The account blocks you the moment the transfer clears.
- You receive card numbers that fail at checkout, because the issuer cancelled them weeks ago.
- You send your own name, address, or photo ID during a "verification" step, and that data gets used against you.
- You are talking to a fraud team or an undercover investigator running a trap.
There is no refund policy and no support line for these deals. Complaining about a bad purchase means admitting you tried to buy stolen credentials.
Is Buying a CVV Illegal?
Yes. In the United States, card credential trafficking is covered by 18 U.S.C. Section 1029, which makes it a federal felony. Sentences run to years in prison, and fines climb with the number of cards and the dollar value involved.
Comparable laws exist in the UK, Canada, Australia, and across the EU. Prosecutors charge buyers, not only sellers and thieves. A purchase that feels anonymous leaves payment trails, chat logs, and shipping records.
Card Verification at Checkout: What Gift Retailers Should Expect
If you sell gifts, flowers, or greeting cards online, you are a card-not-present merchant, and verification settings decide how much fraud you absorb.
- CVV required: the baseline setting. Declining a mismatch stops the bulk of copy-pasted card numbers.
- Address Verification Service (AVS): compares the billing street number and postcode with the issuer's records. Useful for physical gift shipments.
- 3-D Secure or SCA: the bank pushes a code to the cardholder's phone. Strongest check, with some checkout friction.
- Manual review flags: gift cards, bulk orders, and mismatched billing and delivery countries deserve a second look.
- Do not store the CVV: keeping it after authorization breaks PCI DSS and turns a small fraud problem into a serious compliance one.
Chargeback fees usually cost more than the order itself. Tight verification settings pay for themselves on high-value gift baskets and same-day flower delivery.
How to Protect Your Own CVV
Your code is worth stealing because it completes a purchase that a card number alone cannot. A few habits block most attempts.
- Never read your CVV aloud to someone who called you. Your bank already has it.
- Do not email, text, or upload a photo of the front and back of your card.
- Use a virtual card number from your bank or a payment app for one-off gift purchases.
- Treat any request to pay with gift cards as a scam. The caller wants the codes, not the plastic.
- Check statements before the statement period ends, not after.
Frequently Asked Questions
Is buying CVV data ever legal?
No. The only lawful ways to hold a CVV are to be the cardholder, to receive it from the cardholder's own bank, or to be a merchant collecting it for a specific, authorized transaction.
Why do so many sites claim to sell CVVs?
They target search traffic and hope for deposits. Their income comes from advance payments, not from delivered card data, and many of them exist to collect buyer identities.
Do I need to give my CVV when I buy a greeting card or gift online?
Usually yes. Card-not-present merchants collect it to confirm you hold the card, and PCI DSS forbids them from keeping it after the transaction settles.
What should I do if my CVV was stolen and used?
Call your bank, freeze or replace the card, and dispute the charges. Then file a report with your national fraud agency, such as the FTC or the FBI's Internet Crime Complaint Center in the United States, or Action Fraud in the UK.
The Bottom Line
There is no product called a CVV to buy. The code belongs to a cardholder, no legal business stores or resells it, and every offer you find leads to a scam, a sting, or a criminal charge. If you shop for gifts online, share your code only with the checkout page you trust, and check your statement afterwards.