CVV2 is the three-digit security code on the back of most Visa, Mastercard, and Discover cards. It belongs to one specific account and is never sold on its own. A search for "buy CVV2" leads to stolen card data, and buying, selling, or using that data counts as payment fraud in the US, the UK, the EU, and most other markets.
What does "buy CVV2" really mean?
The phrase comes from carding forums and dark web listings. Sellers there offer stolen card numbers bundled with the matching verification code so a buyer can push a charge through an online checkout. The codes come from real cardholders, which makes every sale a transfer of stolen property rather than a product purchase.
Greeting card and gift shops never sell codes by themselves. When a legitimate store asks for your CVV2, it does so at checkout to confirm you hold the card.
What the CVV2 is designed to do
The code proves the person typing the card number has the physical card. Online merchants request it, and card network rules bar them from storing it once the transaction is approved. That short lifespan is the point. A stolen code goes stale fast.
Why a CVV2 has no value on its own
A code without a card number, expiration date, and cardholder name cannot pass a checkout. That is why sellers bundle them. The bundle, not the code, is what buyers pay for, and the bundle is stolen data.
Is it legal to buy CVV2 data?
No. In the United States, 18 U.S.C. 1029 makes it a federal crime to traffic in stolen card numbers and verification codes, and convictions carry prison time and fines. Similar statutes exist across Europe, Canada, and Australia. A buyer can also face identity theft or money laundering charges depending on how the data gets used.
There is no license, no reseller program, and no legal marketplace for these codes. Any site offering them is either a fraud operation or a scam aimed at the buyer.
How do you protect your CVV2 while gift shopping?
Treat the code like cash. The steps below cut your exposure without slowing down a normal purchase.
- Shop on sites with a real business address, phone number, and return policy.
- Use a digital wallet or a virtual card number when you buy from a shop you have not used before.
- Never read the code aloud to someone who calls you. Banks, card networks, and delivery services do not ask for it.
- Keep one card for online gift shopping so a breach stays contained.
- Check your statement every week and dispute anything you do not recognize.
What should you check before buying gifts or gift cards online?
Four parameters separate a safe shop from a risky one.
- Seller identity: a company name, street address, and working phone line. A contact form alone is not enough.
- Payment options: credit cards and digital wallets come with dispute rights. Wire transfers, crypto, and gift card payments do not.
- Delivery terms: tracked shipping and a stated window. Gift cards should arrive by email with a code you can test at checkout.
- Return policy: written terms with a deadline and a refund path.
Gift card purchases deserve extra care
Gift cards are the payment method of choice for scammers because transfers settle fast and reverse with difficulty. Buy them from the retailer or a known store, not from a stranger on a marketplace. Inspect the packaging for a peeled sticker or a scratched-off code before you pay.
Which warning signs point to a card-data scam?
- A shop that asks for your CVV2 by email, chat, or phone before a purchase.
- Prices far below market on popular items, with pressure to pay by wire or crypto.
- A checkout page with no padlock, no company details, and no terms.
- Anyone who offers to "verify" your card by asking for the code plus a one-time password.
- Listings that advertise card data, dumps, or fullz next to normal products.
Where can you buy greeting cards and gifts with confidence?
Order from the brand's own site, a major marketplace with buyer protection, or a local shop you can walk into. Cards and gifts move through normal retail channels, and none of them require you to share a security code outside a checkout form.
What do you do if your card details were used?
Call the number on the back of your card and ask for the fraud team. Under the Fair Credit Billing Act, US cardholders can dispute unauthorized charges within 60 days of the statement date. The issuer will cancel the card, issue a new number, and open a fraud case.
Then file a report with the FTC at ReportFraud.ftc.gov and with the FBI's Internet Crime Complaint Center if money left your account. Those reports feed into investigations and support your dispute if the issuer pushes back.
Is it ever safe to send someone my CVV2?
No. Share it only inside a payment form on a site you trust. No support agent, courier, or seller needs it over chat or phone.
What happens if a gift card is bought with a stolen card?
The charge gets disputed and the gift card can be voided. Retailers log activation, and issuers can trace the transaction back to the account it came from.