What a CVV Is
A CVV is a short code printed on a payment card. Visa, Mastercard, and Discover print three digits on the back. American Express prints four digits on the front. Networks also call it CVV2, CVC2, or CID.
The code proves that the person entering card details holds the plastic. Merchants ask for it on card-not-present orders, such as phone sales and online checkouts.
PCI DSS Requirement 3.2 lists the CVV as sensitive authentication data. A merchant may not store it after an authorization. That rule has applied to every PCI DSS version since 2004.
Why No One Sells a CVV
There is no legal market for CVVs. The code belongs to a cardholder account, and the issuer does not sell it. Any listing that offers CVVs for sale is selling stolen data or a fabricated number.
Legitimate virtual card numbers do exist. Banks and issuers issue them to their own customers, tied to that customer's account and spending limit. That is a different product from a CVV bought from a stranger.
Legal Position
In the United States, 18 U.S.C. 1029 covers fraud and related activity in connection with access devices. Trafficking in card verification values falls under that statute. Penalties reach 10 years for a first offense and 15 years for certain repeat offenses.
In the United Kingdom, the Fraud Act 2006 and the Computer Misuse Act 1990 apply. Across the EU, Directive 2013/40/EU requires member states to criminalize the production and sale of tools used for card fraud. Buying is chargeable conduct in these jurisdictions, not just selling.
Pitfalls for Anyone Considering a Purchase
Escrow is not available. Sellers ask for crypto and hold no identity. The buyer has no contract to enforce and no way to reverse the transfer.
- Lists get resold to many buyers. The same number may have been used and blocked weeks earlier.
- Fake entries are common. A random three-digit string costs the seller nothing.
- Card testing draws issuer attention. Banks close accounts and flag the IP and device.
- Reporting the loss means describing the purchase to police, a bank, or a platform.
Legitimate Alternatives
- Retail gift cards. Buy them at the register or from the retailer's own site.
- Prepaid cards. Sold at supermarkets and pharmacies with a fixed balance.
- Virtual card numbers from your bank. Set a spend cap for each merchant.
- A second credit card with a low limit, used for online orders.
Where to Report Card Fraud
In the US, contact the card issuer first, then file a report with the FTC and the FBI Internet Crime Complaint Center. In the UK, Action Fraud takes reports. Keep the card statement and any messages from the seller.