What the term means
CVV is the card verification value: three digits on the back of a Visa, Mastercard or Discover card, four digits on the front of an American Express card. Listings that appear under a buy cvv website search offer card numbers paired with those codes. The records come from cardholders who did not sell them. Sellers on those sites take crypto and hand over data with no way to check origin.
Legal status
In the United States, 18 U.S.C. 1029 covers trafficking in access devices. Convictions carry prison terms that reach 10 years for many offenses, plus fines. In the United Kingdom, section 6 of the Fraud Act 2006 covers possession of articles for use in fraud. Card network rules bar merchants from storing the CVV after authorization, so no licensed business resells it.
Why this site does not publish a buying guide
No greeting card or gift shop can verify a seller of stolen card data. Buyers on those sites report three outcomes: the same card number sold to several buyers, a payment taken with no data delivered, or a data set that fails at checkout. Each is a loss. None is a purchase with recourse.
Card fraud that hits gift and greeting card sellers
Card testing is the common attack on gift shops. A bot runs small orders with stolen numbers to see which ones approve. Signs: a rise in orders under $5, many declines from one IP range, and several cards used on one account. Gift card draining is the second pattern. A stolen card buys a gift card, and the code is spent before the chargeback arrives.
Controls that reduce the damage
- Address verification (AVS) on every order, with a rule to hold mismatches.
- 3-D Secure for card not present orders above a set value.
- PCI DSS scope kept small. Requirement 3.2 bars storage of sensitive authentication data after authorization.
- Velocity limits per IP, per email domain and per card.
- Manual review of gift card orders that ship to an address other than the billing address.
What is not known
Loss totals for card not present fraud vary by source and year. FBI IC3 and the FTC publish different measures, so figures from one report should not be compared with the other.