Buying a CVV means buying stolen card data, and that is a crime in the United States and in most other countries. A CVV on its own is useless, so sellers bundle it with a card number, a cardholder name, and an expiry date to make online orders possible. There is no legal marketplace for CVV numbers, and the sites that claim to be one are either scams or police stings.
What Is a CVV Code?
A CVV is the short security code printed on a payment card. It proves the card sits in the buyer's hands at the moment of an online purchase, when no chip or magnetic stripe can be read.
- Visa, Mastercard, Discover: three digits on the back of the card.
- American Express: four digits on the front, sometimes labeled CID.
- Job: a card-not-present check for online orders, phone orders, and gift purchases.
- Storage: PCI DSS rules bar merchants from keeping the code in their systems after a transaction authorizes.
Because merchants cannot store it, the code is the one piece of card data a thief cannot pull from a retailer's database breach. That is the reason stolen card listings always advertise the CVV as the headline item.
Is Buying a CVV Legal?
No. Buying card data falls under access device fraud in the United States, and the purchase itself can bring charges even when the buyer never places a single order.
Federal prosecutors bring these cases under 18 U.S.C. § 1029, then stack on wire fraud and identity theft counts. Sentences carry prison time, fines, and restitution to the people whose cards were drained.
Canada, the UK, and EU member states have matching laws. A buyer sitting in one country and a cardholder in another does not create a safe gap, because card networks route every transaction through a bank that reports fraud.
Why "CVV Shops" Are Scams or Traps
Most sites that sell card data make money from the buyer, not from the card. They resell one stolen card to dozens of people and keep the payment.
- Sold many times over. The first buyer who tries an order may succeed, and everyone after that gets a blocked charge.
- Issuer flags. Banks score each purchase against the cardholder's normal spending. A strange merchant, a new device, and a mismatched address trip the fraud model.
- Address verification. AVS checks the billing address against the bank record, and a mismatch ends the order.
- Honeypots. Some "shops" are run with law enforcement. Buyers hand over wallet details and shipping addresses, and those records become evidence.
- No recourse. A buyer who pays in crypto and gets nothing back cannot file a chargeback, because the transaction was never legal.
What Happens When a Stolen Card Funds an Online Gift Order?
The order ships somewhere, and that address is the thread investigators pull. Retailers keep the IP log, the device fingerprint, the email, and the delivery record for years.
The cardholder disputes the charge, the merchant eats the loss, and the merchant hands the order data to the card network and to police. A greeting card or gift order looks harmless, but it leaves the same paper trail as any other fraudulent purchase.
How to Protect Your Own Card and CVV
Card skimming and phishing sites are the usual source of stolen card data, so defense starts with where you type the number.
- Use virtual card numbers from your bank or card app for online gift shopping. Each number works at one merchant and expires.
- Never read your CVV into a chat, an email, a DM, or a phone call. No real support agent needs it.
- Check the address bar before you pay, and avoid stores that appear only in social ads with no company details.
- Turn on transaction alerts so a charge you did not make reaches you within seconds.
- Cover the keypad and the card face when you pay in a shop, and check card readers for loose parts.
- Review statements each month. Small test charges of a dollar or two often come before a large one.
Safer Ways to Buy Gift Cards and Greeting Cards
Gift cards carry value but not a CVV, which makes them a low-risk way to send money to someone. Buy them from the retailer or the card issuer, not from a reseller on a marketplace.
For physical cards, check the back for scratches over the PIN strip and keep the receipt. For digital cards, buy on the issuer's own site and send the code through the issuer's delivery tool rather than a screenshot.
Common Questions
Can a CVV be sold on its own?
A CVV alone cannot approve anything. It only works paired with a card number, an expiry date, and a name, which is why sellers list all four together.
Why do CVV sellers want cryptocurrency?
Crypto lets them take money with no bank in the middle and no refund path. It also hides the seller, so the buyer has nothing to dispute.
What do I do if someone used my card's CVV?
Call the number on the back of your card and ask for the card to be frozen and replaced. Then dispute the charges in writing, and file a report with the FTC and the FBI's Internet Crime Complaint Center.
Is a gift site with "CVV" in its name safe?
Treat it as a warning sign. Legitimate retailers have no reason to name a shop after a security code.
The Short Version
Buying a CVV is card fraud, not a bargain, and the listings that promise cheap card data exist to take the buyer's money. The legal, working alternative is simple: buy gift cards from the issuer, guard your own code, and report any charge you do not recognize.